Hello everybody I have a question and, maybe, someone could help me. The manual of tcpdump says that:'The timestamp reflects the time the kernel first saw the packet'
Well, I would like to know when the kernel first saw the packet. It means, the interrupt of a 'new packet' is sent at kernel when the NIC sees the first bit of a new packet or when the NIC sees the last bit (totally transfered). Thank you very much Curro - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:tcpdump-workers-request@;tcpdump.org?body=unsubscribe
