On 05/11/2012 06:26 AM, Wiener Schnitzel wrote:
I see. As I said, I might need to merge the data coming from the interfaces, so I need an algorithm to compare the age of packets with different sources.
I don't think you will be able to arrive at that goal with perfect accuracy. Can it be like the game of horseshoes and be "close enough?"
In addition to packets from even the same interface taking different paths up the stack, there is also the matter of different interfaces providing notification of packet arrival at the host at different times - mechanisms like interrupt avoidance/coalescing mean that if Packet 1 arrived on NIC A a microsecond before Packet 2 arrived on NIC B, NIC B may still tell the host about Packet 2 before NIC A told the host about Packet 1.
You could I suppose disable interrupt coalescing, and perhaps even get NIC HW timestamping going, but even then I suspect there will be some skew between NIC A's concept of time and NIC B's
I trust there isn't any assumption being made about the relative send times of packets based on their arrival times - certainly in different flows, but depending on the nature of the transport(s) carrying the flows perhaps even within a single flow (eg a flow of UDP traffic)
rick jones - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
