Re: Multiple interface capture and thread safety

[Rick Jones <rick.jones2 () hp com>]

On 05/11/2012 06:26 AM, Wiener Schnitzel wrote:
> I see. As I said, I might need to merge the data coming from the
> interfaces, so I need an algorithm to compare
> the age of packets with different sources.

I don't think you will be able to arrive at that goal with perfect 
accuracy.  Can it be like the game of horseshoes and be "close enough?"

In addition to packets from even the same interface taking different 
paths up the stack, there is also the matter of different interfaces 
providing notification of packet arrival at the host at different times 
- mechanisms like interrupt avoidance/coalescing mean that if Packet 1 
arrived on NIC A a microsecond before Packet 2 arrived on NIC B,  NIC B 
may still tell the host about Packet 2 before NIC A told the host about 
Packet 1.

You could I suppose disable interrupt coalescing, and perhaps even get 
NIC HW timestamping going, but even then I suspect there will be some 
skew between NIC A's concept of time and NIC B's

I trust there isn't any assumption being made about the relative send 
times of packets based on their arrival times - certainly in different 
flows, but depending on the nature of the transport(s) carrying the 
flows perhaps even within a single flow (eg a flow of UDP traffic)

rick jones

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.