Re: where does PCAP timestamp before or after the

[Fabian Schneider <schneifa () net in tum de>]

Hi,

> We want to know where/when does PCAP put the timestamp (from not 
> so accurate kernel time) on to the packets. I already know,  it does 
> when the kernel "sees" the packet. The question is: Is it after or before 
> the MAC scheduler? I mean, does it in TR or RX buffers or at higher 
> protocol layers take place?

Under Linux (at least 2.6.x) the received packets are timestamped in 
netif_rx() direcly after the driver has setup a sk_buff for the packet. 
This is before the receiving interrupt is distributing the sk_buff (the 
struct in which the Linux kernel stores packets) to the interested 
receivers of which one is the sniffing "socket" as they call it within the 
linux kernel and another is the TCP/IP stack (ip_rcv()). 

For the sending of the packet i am not sure, but i think this happens 
directly before the packet it handed to the driver function. 

But what exactly is the "MAC scheduler"? I have not yet heard of it.

   mfG  
   Fabian Schneider

-- 
Fabian Schneider,  Technische Universität München
address: Boltzmannstr. 3, 85748 Garching b. Münchenn
e-mail: fabian () net in tum de, WWW: http://www.net.in.tum.de/~schneifa 
phone: +49 89 289-18012, mobile: 0179/2427671-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.