When the packet arrives the NIC generates an interrupt and the kernel then takes over. I want to measure the time at which a packet of a particular TCP flow arrives.

How do I do this in Linux? This what tools like tcpdump do.


3 Answers 3


tcpdump timestamps all the packets. So you should be able use tcpdump. Otherwise you could try wireshark, which also monitors network trafic, but with a nice and powerfull GUI. If you don't need to script this process, I would say Wireshark is your friend in this situation.

You can take a peek at http://www.howtogeek.com/104278/how-to-use-wireshark-to-capture-filter-and-inspect-packets/ for more info on how to use Wireshark.

If you are more interested in how to measure this yourself you could either inspect tcpdump with strace or, as suggested, read the source. strace will gives you a list of system calls that you can use in your own application. The easiest solution however, would be to run tcpdump, and then filter the output through awk or some other tool capable of filtering out the timestamp column.

Also, you can find more information about how to use tcpdump on http://danielmiessler.com/study/tcpdump/

  • I want to know how tcpdump does it
    – Bruce
    Commented Aug 8, 2012 at 14:42
  • 2
    So read the source and ask if you have questions about it
    – Useless
    Commented Aug 8, 2012 at 16:20
  • expanded answer with some words about the internals
    – Kotte
    Commented Aug 9, 2012 at 5:10

Take a look at tcptrack tool. You might be able to measure this.

  • I don't see how. Tcptrack displays connection statistics, not per-packet processing information. Commented Aug 5, 2012 at 22:26

Do you mean like traceroute? The -p option permit to choose the protocol.

[root@osgiliath ~]# traceroute myserver.mydomain.com -p 443
traceroute to myserver.mydomain.com (, 30 hops max, 60 byte packets
 1 (  0.262 ms  0.294 ms  0.360 ms
 2 (  0.326 ms  0.387 ms  0.466 ms
 3  myserver.mydomain.com (  7.558 ms  7.558 ms  7.547 ms

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .