Difference between capture timestamp and actual packet timestamp

[mohamedkammoun123]

Hello,

I am observing captured packets using tcpdump and I would like to clarify something regarding timestamps.

Is it normal that the capture timestamp differs from the actual packet transmission time by around 1 millisecond? I want to understand if this difference is expected due to the capture process, or if it indicates some misconfiguration or system delay.

Thank you for your guidance.

[guyharris]

Is it normal that the capture timestamp differs from the actual packet transmission time by around 1 millisecond?

Are these packets received by the machine running tcpdump, sent by the machine running tcpdump, or both?

[mohamedkammoun123]

These are the packets received by the machine running tcpdump (Android device)

[guyharris]

These are the packets received by the machine running tcpdump (Android device)

So what machine is sending the packets. and how do you determine the packet transmission time? Presumably that is being done on the machine sending the packet.

[mohamedkammoun123]

The packets are being sent by another machine; these are TWAMP test packets. On my Android device running tcpdump, I use a **callback in my native code when i detect received packet to record and display the timestamp of when each packet is received.

[guyharris]

The packets are being sent by another machine; these are TWAMP test packets. On my Android device running tcpdump, I use a **callback in my native code when i detect received packet to record and display the timestamp of when each packet is received.

Earlier you said

Is it normal that the capture timestamp differs from the actual packet transmission time by around 1 millisecond?

Presumably the packet transmission time is the one in the test packet; an OWAMP test packet has a timestamp, presumably the transmission time, and TWAMP test packets are "similar to the OWAMP-test protocol [RFC4656] with the exception that the Session-Reflector transmits test packets to the Session-Sender in response to each test packet it receives" and "The Session-Sender packet format and content follow the same procedure and guidelines as defined in Section 4.1.2 of OWAMP [RFC4656] (with the exception of the reference to the send schedule)."

Some reasons for that timestamp to be different from the receive timestamp are:

1. the time at which the timestamp to put in the packet is requested may be before the time at which the packet is handed to the device driver for the network adapter on which it will be sent;
2. the time at which it's handed to the driver may be earlier than the time at which the packet makes it onto the network;
3. the time at which the packet makes it onto the network may be earlier than the time at which the packet makes it to the receiving network adapter.

The callback is presumably to a program other than tcpdump; is it receiving those packets on a socket, in which case what type of socket is it, or is it receiving those packets by some other mechanism, in which case what mechanism is that?