tcpdump real time stamp

[Jeffrey Mogul]

I need some enlightment on the time stamp tcpdump puts upon
receiving filtered packets:

first case: I'm capturing packets sent by local host (SS
Solaris2.4, no need to set copy-all on net interface). What I get
is the time when packets are initially sent by the kernel to the
net interface driver or the time when they are received back by the
kernel after passing through the net-interface-filter ?

second case: I'm capturing packets from the net and sent by other
hosts (on a DecAlpha, Dec-Unix, packet filter). What I get is the
time when a selected packet issues from the packet filter which
might be the same as the time this packet is received in a stream
socket ?

I don't know when Solaris sets the timestamp, but on Digital UNIX
(and on ULTRIX, for that matter), the timestamp is effectively
set inside the interface device interrupt handler. Think of
the procedure as something like this:

interrupt arrives:
interrupt handler loops on all packets in interface buffers
doing
check hardware status
create mbuf chain containing packet
possibly make a copy of the packet for delivery
to host's actual IP layer
*obtain timestamp*
for each filter predicate
if pkt matches, place pkt pointer on per-filter queue
do other bookkeeping stuff

The timestamp could probably be obtained a little earlier in the
process, but this is what we do now. Anyway, if the packet arrival
rate is low, the timestamp should be generated within a few tens of
microseconds after the packet is fully received by the interface.
If the packet arrival rate is high, queueing delay in this loop
may add a lot more time between packet arrival and timestamp
generation.

-Jeff