How to measure the time when a packet arrives?

Question

When the packet arrives the NIC generates an interrupt and the kernel then takes over. I want to measure the time at which a packet of a particular TCP flow arrives.

How do I do this in Linux? This what tools like tcpdump do.

Answer 1

Take a look at tcptrack tool. You might be able to measure this.

Answer 2

tcpdump timestamps all the packets. So you should be able use tcpdump. Otherwise you could try wireshark, which also monitors network trafic, but with a nice and powerfull GUI. If you don't need to script this process, I would say Wireshark is your friend in this situation.

You can take a peek at http://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/ for more info on how to use Wireshark.

If you are more interested in how to measure this yourself you could either inspect tcpdump with strace or, as suggested, read the source. strace will gives you a list of system calls that you can use in your own application. The easiest solution however, would be to run tcpdump, and then filter the output through awk or some other tool capable of filtering out the timestamp column.

Also, you can find more information about how to use tcpdump on http://danielmiessler.com/study/tcpdump/

Answer 3

Do you mean like traceroute? The -p option permit to choose the protocol.

[root@osgiliath ~]# traceroute myserver.mydomain.com -p 443
traceroute to myserver.mydomain.com (10.11.20.30), 30 hops max, 60 byte packets
 1  10.119.9.253 (10.10.10.1)  0.262 ms  0.294 ms  0.360 ms
 2  10.111.225.114 (10.11.20.14)  0.326 ms  0.387 ms  0.466 ms
 3  myserver.mydomain.com (10.11.20.30)  7.558 ms  7.558 ms  7.547 ms