Re: Help with timestamp

[Guy Harris <guy () alum mit edu>]

On Mon, Jul 14, 2003 at 08:47:59PM +0100, Marcos Paredes Farrera wrote:
> So it means that for delivered packets the timestamp is done at the packet
> beginning.

It's done before the packet begins to be transmitted.  How long before
depends on the length of the code path between that point and the point
at which the network interface puts the packet on the wire (including
code on the network interface itself) - and any delays on that wire due
to admission control, carrier being present, etc..

> > In the second case, it's assigned whenever the packet is supplied, by
> > the device driver or networking stack, to whatever piece of code
> > time-stamps the packet; that's after the lat bit is received.
>
> And for received Packets the time stamp is at the packet end.

It's done after the entire packet has been received.  How long after
depends on the length of the code path between the point at which the
last byte of the packet is received by the network interface and the
point at which the packet is time-stamped (including code on the network
interface itself).

> So if we have a tcpdump output with information  of every packet in the
> interface, the timestamping is different between the outgoing and incoming
> packets in that interface.

Yes, "different" in the sense that the time stamp of outgoing packets is
earlier than the point at which *any* of the packet's bits are
transmitted and the time stamp of incoming packets are later than the
point at which *any* of the packet's bits are received.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe