[Winpcap-users] Delay and jitter

[Guy Harris]

On Nov 29, 2006, at 1:47 PM, Gianluca Varenni wrote:


> If you need to compute the jitter and delay between packets, you  
> need to process the timestamps attached to each packet (in the  
> pcap_pkthdr header). Regarding a microsecond precision, remember  
> that packets are timestamped not when the board receives them, but  
> when the capture engine in the kernel (being it windows or linux)

...or Mac OS X or {Free,Net,Open,DragonFly}BSD or Solaris or HP-UX or  
Digital/Tru64 UNIX or IRIX or...

> processes them, and this can introduce a delay of some microseconds  
> (this is due to a number of reasons, e.g. interrupt mitigation, the  
> network card does not generate an interrupt for every received  
> packet, but rather batches the received packets for some  
> microseconds in order not to generate too many interrupts).

I.e., the time stamps might have high precision (depending on your  
hardware and whether the OS uses high-resolution timer hardware for  
packet time stamping), but they very precisely measure the time at  
which they're seen by the code that time-stamps them, rather than the  
time that they actually arrived at your network adapter - the two  
times might be significantly different.