When tcp timestamp is on, does it send a timestamp with every tcp packet?

If so, how big is the timestamp?

The reason I ask, is that I turned off tcp timestamp at the first of the month. The forecast of bandwidth that I will have used for this month is around 300GB. Last month, when i had tcp timestamp on, i only used around 400GB.

100gb drop.. thats a lot.. im just wondering if it may have something to do with tcp timestamp?

It depends on the OS and what the other end of the connection requests.

Typically, if Linux receives a packet with a timestamp, it will echo it back, and add its own timestamp. But if the other end doesn't open the negotiation by sending timestamps, it won't add any to it's acks.

If Linux is the one opening the TCP connection, it will attempt to negotiate timestamps and will request and send a timestamp with each packet (by default, with TCP timestamps on).

If the client requests a timestamp, and you've turned it off, the other side will just assume that you're not RFC 1323 compliant, but hopefully life will go on with a theoretically less stable TCP connection that is more prone to reset.

Although I could be wrong. It's possible that turning off the TCP timestamp in your OS will only result in it not opening connections with it on, but it may still echo the other end's.

It looks like the timestamp is 10 bytes.

Timestamps will only be used if an application specifically requests them or if the connection data rate is extremely high. Even when they are used, they add no more than 1% to the total traffic volume.

ill be glad to take the 1% :)

If I remember correctly, you will only be saving 4 bytes per packet.
(8 bytes with ACK)

Personally, I think it was an interesting idea to save on traffic and bandwidth. Let us know if you experience any problems. :)