Re: timestamp in Packet Data

[Guy Harris <guy () alum mit edu>]

On Jul 9, 2011, at 6:52 PM, Sanjay Sundaresan wrote:

> Is the approximation because of the fact that NIC card generarates interrupt
> only after some number of packets arrive ?

Yes, that's one of the reasons.  There's also the delay between the arrival of the packet and the delivery of the 
interrupt and the delay between the time the interrupt arrives for the packet and the time when the networking stack 
sets the time stamp.

> Does device polling affect time stamp ?

Yes, it could - if it's used to batch up packets, so that, instead of one interrupt per packet, there's one periodic 
interrupt that might correspond to several packets that can add an additional delay.

> At what stage of capture time stamping is done ?

It depends on the operating system.  It happens after the interrupt that notifies the host of the arrival of the 
packets and, assuming the packets aren't duplicated (or lazily duplicated) and processed on different threads, before 
the packet is delivered to, for example, IPv4 or IPv6.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.