Re: Where are incoming packets timestamped at kernel level?

[Guy Harris <guy () alum mit edu>]

On Aug 17, 2011, at 2:57 PM, Fabrizio Giordano wrote:

> Do you guys know where packets are timestamped in the kernel?
> I'm using a 2.6.32-131.4.1.el6.x86_64 kernel

I.e., Linux, of somewhat recent vintage.

The time stamp would be in the skb->tstamp field for the packet in question.  If the adapter doesn't do hardware 
timestamps, the time stamp would be set in a call to the __net_timestamp() inline function from the skbuff.h header 
file, at least according to my 2.6.32.4 kernel tree.  That's called by net_timestamp() in net/core/dev.c, which is 
called from netif_rx() or netif_receive_skb().  Those appear to be called from the network adapter driver; they're 
called to hand incoming packets to the networking stack.  In, for example, the ixgb driver, it's called from 
ixgb_clean_rx_irq().

Executive summary: packets are, in general, timestamped when they're first handed to the networking stack.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.