On Mon, Feb 17, 2003 at 08:47:48AM +0200, Dangis wrote: > Who know, when Ethereal (or Wincap) registering arrived packet timestamp?
Ethereal doesn't add the time stamp to packets; that's done by libpcap/WinPcap, so you should probably ask the WinPcap developers if you're running on Windows. However: > May be that registering packet arrival after CRC calculation (or before)? It is almost certainly after the CRC calculation. The time stamp is added to the packet by the WinPcap driver, after the packet has been supplied to it by the network device driver. That means that the packet is applied after the network driver has processed the packet - which won't happen until the network interface delivers the packet to the driver. As the CRC calculation is done by the network interface, and the packet is discarded if the CRC calculation fails, the CRC calculation is done before the interface delivers the packet to the driver.
