On Jul 9, 2011, at 6:52 PM, Sanjay Sundaresan wrote: > Is the approximation because of the fact that NIC card generarates interrupt > only after some number of packets arrive ?
Yes, that's one of the reasons. There's also the delay between the arrival of the packet and the delivery of the interrupt and the delay between the time the interrupt arrives for the packet and the time when the networking stack sets the time stamp. > Does device polling affect time stamp ? Yes, it could - if it's used to batch up packets, so that, instead of one interrupt per packet, there's one periodic interrupt that might correspond to several packets that can add an additional delay. > At what stage of capture time stamping is done ? It depends on the operating system. It happens after the interrupt that notifies the host of the arrival of the packets and, assuming the packets aren't duplicated (or lazily duplicated) and processed on different threads, before the packet is delivered to, for example, IPv4 or IPv6.- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
