Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When the packet arrives the NIC generates an interrupt and the kernel then takes over. I want to measure the time at which a packet of a particular TCP flow arrives.

How do I do this in Linux? This what tools like tcpdump do.

share|improve this question

migrated from stackoverflow.com Aug 5 '12 at 15:36

This question came from our site for professional and enthusiast programmers.

JFTR i would start to look into systemta - have a look at the sample scripts e.g sourceware.org/systemtap/examples/network/netdev.stp – Ulrich Dangel Aug 9 '12 at 16:42

tcpdump timestamps all the packets. So you should be able use tcpdump. Otherwise you could try wireshark, which also monitors network trafic, but with a nice and powerfull GUI. If you don't need to script this process, I would say Wireshark is your friend in this situation.

You can take a peek at http://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/ for more info on how to use Wireshark.

If you are more interested in how to measure this yourself you could either inspect tcpdump with strace or, as suggested, read the source. strace will gives you a list of system calls that you can use in your own application. The easiest solution however, would be to run tcpdump, and then filter the output through awk or some other tool capable of filtering out the timestamp column.

Also, you can find more information about how to use tcpdump on http://danielmiessler.com/study/tcpdump/

share|improve this answer
I want to know how tcpdump does it – Bruce Aug 8 '12 at 14:42
So read the source and ask if you have questions about it – Useless Aug 8 '12 at 16:20
expanded answer with some words about the internals – Kotte Aug 9 '12 at 5:10

Take a look at tcptrack tool. You might be able to measure this.

share|improve this answer
I don't see how. Tcptrack displays connection statistics, not per-packet processing information. – Gilles Aug 5 '12 at 22:26

Do you mean like traceroute? The -p option permit to choose the protocol.

[root@osgiliath ~]# traceroute myserver.mydomain.com -p 443
traceroute to myserver.mydomain.com (, 30 hops max, 60 byte packets
 1 (  0.262 ms  0.294 ms  0.360 ms
 2 (  0.326 ms  0.387 ms  0.466 ms
 3  myserver.mydomain.com (  7.558 ms  7.558 ms  7.547 ms
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.