I am using
tc qdisc to add delay to packets on my interface eth2 as follows
sudo tc qdisc add dev eth2 root netem delay 100ms 10ms 25%
Then I pinged a host and got some result. The results on the terminal showed that the RTT was 74 ms while the RTT that I calculated from the Wireshark time stamp is around 64 ms.
What this suggests me is that Wireshark shows us the packets as soon as from the libpcap. libpcap sits right after the NIC and all the netem delays are added only after libpcap has seen the packet. As for the terminal result, the ping program sees the packet after the netem delay and thus after 100 more ms.
Is there any way I can use Wireshark to see the packets on the application layer or after the netem delay.
If Wireshark cannot do that, can someone suggest me other options? I know I can use another Linux box, outside of my box under test and delay it on the outer box. But I would prefer to avoid using an extra Linux box.