tcpdump mailing list archives
Re: where does PCAP timestamp before or after the
From: Fabian Schneider <schneifa () net in tum de>
Date: Thu, 30 Mar 2006 14:57:32 +0200 (CEST)
Hi,
We want to know where/when does PCAP put the timestamp (from not so accurate kernel time) on to the packets. I already know, it does when the kernel "sees" the packet. The question is: Is it after or before the MAC scheduler? I mean, does it in TR or RX buffers or at higher protocol layers take place?
Under Linux (at least 2.6.x) the received packets are timestamped in netif_rx() direcly after the driver has setup a sk_buff for the packet. This is before the receiving interrupt is distributing the sk_buff (the struct in which the Linux kernel stores packets) to the interested receivers of which one is the sniffing "socket" as they call it within the linux kernel and another is the TCP/IP stack (ip_rcv()). For the sending of the packet i am not sure, but i think this happens directly before the packet it handed to the driver function. But what exactly is the "MAC scheduler"? I have not yet heard of it. mfG Fabian Schneider -- Fabian Schneider, Technische Universität München address: Boltzmannstr. 3, 85748 Garching b. Münchenn e-mail: fabian () net in tum de, WWW: http://www.net.in.tum.de/~schneifa phone: +49 89 289-18012, mobile: 0179/2427671- This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
Current thread:
- where does PCAP timestamp before or after the MAC scheduler? Debrei Gabor (Mar 30)
- Re: where does PCAP timestamp before or after the MAC scheduler? Bruce M Simpson (Mar 30)
- Re: where does PCAP timestamp before or after the Fabian Schneider (Mar 30)
- Re: where does PCAP timestamp before or after the MAC scheduler? David Young (Mar 30)