How to Inspect and Configure Packet Timestamping on Windows 11 Network Adapters Using PowerShell

In latency-critical environments\u2014such as algorithmic financial trading, automated industrial instrumentation, audio/video streaming over Ethernet (AVB/TSN), and distributed telemetry systems\u2014recording the exact nanosecond arrival and departure times of network frames is vital. Traditional software timestamps recorded by the operating system kernel introduce unpredictable latency variations caused by CPU interrupts, DPC scheduling queues, and buffer copies. To provide microsecond- and nanosecond-level accuracy, modern network adapters support IEEE 1588 Precision Time Protocol (PTP) hardware packet timestamping. In Windows 11, you can query and configure packet timestamping capabilities directly using PowerShell.

Understanding Hardware vs Software Packet Timestamping

Packet timestamping operates at two distinct layers within the Windows networking stack:

• Hardware Timestamping (IEEE 1588 / PTP): The physical PHY or MAC layer of the network adapter marks packets with a hardware counter timestamp immediately as the first bit enters or exits the physical wire. This eliminates all operating system jitter and context-switch delays.
• Software Timestamping: The NDIS (Network Driver Interface Specification) miniport driver or TCP/IP stack timestamps packets as they are processed in kernel memory. While less accurate than hardware PHY timestamps, it provides microsecond-level timing when hardware support is absent.
• Cross-Timestamping: Allows Windows to correlate network adapter hardware clocks directly with the CPU system performance counter (TSC / QPC), synchronizing local device clocks with network time.

Querying Packet Timestamping Capabilities via PowerShell

Windows 11 includes dedicated NetAdapter cmdlets to inspect timestamping hardware support. Open PowerShell with administrative privileges:

Get-NetAdapterPacketTimeStampCapabilities

The command lists timestamping attributes for all installed network adapters:

Name                                    : Ethernet 1
InterfaceDescription                   : Intel(R) I225-V Gigabit Network Connection
HardwareTimestampCapabilities           : AllReceive, PtpV2OverUdpIPv4Event
SoftwareTimestampCapabilities           : AllReceive, AllTransmit
CaptureTimestampCapabilities            : Receive, Transmit

To inspect detailed hardware capabilities for a specific adapter:

Get-NetAdapterPacketTimeStampCapabilities -Name "Ethernet 1" | Format-List *

Key properties to examine:

• HardwareTimestampCapabilities: Indicates whether the adapter supports hardware-level timestamping for all packets (AllReceive) or specific PTP event frames (PtpV2OverUdpIPv4Event).
• CrossTimestamp: Confirms whether the NIC hardware clock can be read atomically alongside the Windows OS system clock.

Configuring Hardware Packet Timestamping Properties

On supported enterprise network cards (Intel, Broadcom, Mellanox/NVIDIA, Marvell), driver properties control how hardware timestamping registers are populated.

To inspect available timestamping driver settings:

Get-NetAdapterAdvancedProperty -Name "Ethernet 1" | Where-Object { $_.DisplayName -like "*Timestamp*" -or $_.DisplayName -like "*PTP*" }

To enable hardware timestamping on the network adapter:

Set-NetAdapterAdvancedProperty -Name "Ethernet 1" -DisplayName "Hardware Timestamping" -DisplayValue "Enabled"

Or configure IEEE 1588 PTP Hardware Timestamping explicitly:

Set-NetAdapterAdvancedProperty -Name "Ethernet 1" -DisplayName "PTP Hardware Timestamp" -DisplayValue "Enabled"

The network adapter will reinitialize briefly (1 to 2 seconds) to apply the register configuration to the PHY controller.

Verifying Active Socket Timestamping in Windows Applications

Windows applications (such as PTP daemons, Wireshark, or financial execution engines) request timestamps by setting Winsock socket options (such as SO_TIMESTAMP or SO_TIMESTAMPING). When configured, the Windows NDIS stack attaches out-of-band timestamp structures (NET_BUFFER_LIST_TIMESTAMP) to incoming packets.

You can capture these hardware timestamps in packet analysis utilities like Wireshark by checking the packet metadata headers under Frame > Epoch Time and Hardware Timestamp.

Restoring Default Adapter Timestamping Settings

If you experience driver instability or network throughput degradation when enabling experimental timestamping flags, reset advanced properties to manufacturer defaults:

Reset-NetAdapterAdvancedProperty -Name "Ethernet 1" -DisplayName "Hardware Timestamping"
Reset-NetAdapterAdvancedProperty -Name "Ethernet 1" -DisplayName "PTP Hardware Timestamp"

The adapter restores standard factory offload profiles, ensuring stable general-purpose networking.