When is a packet time-stamped? How accurate are the time stamps?
Tcpdump gets time stamps from libpcap, and libpcap gets them from the OS kernel, so tcpdump – and any other program using libpcap, such as Ethereal or snoop – is at the mercy of the time stamping code in the OS for time stamps. In most OSes on which tcpdump and libpcap run, the packet is time stamped as part of the process of the network interface’s device driver, or the networking stack, handling it. This means that the packet is not time stamped at the instant that it arrives at the network interface; after the packet arrives at the network interface, there will be a delay until an interrupt is delivered or the network interface is polled (i.e., the network interface might not interrupt the host immediately – the driver may be set up to poll the interface if network traffic is heavy, to reduce the number of interrupts and process more packets per interrupt), and there will be a further delay between the point at which the interrupt starts being processed and the time stamp is generat
