On Fri, Jan 26, 2001 at 04:50:25PM -0800, Faisal Siddiqi wrote:
> Does tcpdump's timestamping work in kernel space for Linux
The time stamping, on Linux, for all applications using libpcap to
capture packets, including but not limited to tcpdump, is done with an
SIOCGSTAMP "ioctl" on the capture socket.
That "ioctl" copies up to userland a time stamp attached to the socket;
that time stamp is set when a packet is received on the socket from the
networking code - it's copied from the time stamp on the packet itself.
That time stamp is set when a packet is received from a device driver.
So, yes, it works in kernel space, in the sense that the packet is
stamped by the kernel with a time of arrival, and that time stamp is
used, not the time at which the userland code in libpcap actually reads
the packet.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
