When the packet arrives the NIC generates an interrupt and the kernel then takes over. I want to measure the time at which a packet of a particular TCP flow arrives.
How do I do this in Linux? This what tools like tcpdump do.
1
-
1JFTR i would start to look into systemta - have a look at the sample scripts e.g sourceware.org/systemtap/examples/network/netdev.stp– Ulrich DangelAug 9, 2012 at 16:42
Add a comment
|
3 Answers
tcpdump timestamps all the packets. So you should be able use tcpdump. Otherwise you could try wireshark, which also monitors network trafic, but with a nice and powerfull GUI. If you don't need to script this process, I would say Wireshark is your friend in this situation.
You can take a peek at http://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/ for more info on how to use Wireshark.
If you are more interested in how to measure this yourself you could either inspect tcpdump with strace or, as suggested, read the source. strace will gives you a list of system calls that you can use in your own application. The easiest solution however, would be to run tcpdump, and then filter the output through awk or some other tool capable of filtering out the timestamp column.
Also, you can find more information about how to use tcpdump on http://danielmiessler.com/study/tcpdump/
-
-
2
-
Take a look at tcptrack tool. You might be able to measure this.
-
I don't see how. Tcptrack displays connection statistics, not per-packet processing information. Aug 5, 2012 at 22:26
Do you mean like traceroute? The -p option permit to choose the protocol.
[root@osgiliath ~]# traceroute myserver.mydomain.com -p 443
traceroute to myserver.mydomain.com (10.11.20.30), 30 hops max, 60 byte packets
1 10.119.9.253 (10.10.10.1) 0.262 ms 0.294 ms 0.360 ms
2 10.111.225.114 (10.11.20.14) 0.326 ms 0.387 ms 0.466 ms
3 myserver.mydomain.com (10.11.20.30) 7.558 ms 7.558 ms 7.547 ms
