Hello,

I want to capture huge amounts of packets without timestamps, since the
machine the program is running on has a very slow clock that only yields
200,000 timestamps per second and uses 70% of CPU. But tpacket_rcv
reenables the timestamps every time it receives a packet at af_packet.c:643

if (skb->tstamp.tv64 == 0) {
	__net_timestamp(skb);
	sock_enable_timestamp(sk);
}

I suppose that a patch that just removes that four lines won't be
accepted, since breaks an userspace interface. Isn't it?

So I've tried to enable timestamp when you setup the ring (to not affect
other programs) and disabling it latter from user space clearing the
SO_TIMESTAMP option. But it doesn't work, since timestamps can't be
disabled until the socket is closed.

If enabling SO_TIMESTAMP socket option sets SOCK_RCVTSTAMP and calls
sock_enable_timestamp, why disabling it just clears SOCK_RCVTSTAMP and
don't call sock_disable_timestamp?

Thanks.