Subject: Re: Packet reordering in pcap capture file

From: Stephen Hemminger <[email-masked]>
Date: Sat, 5 Aug 2006 09:21:54 -0700

On Sat, 05 Aug 2006 03:28:38 -0400
Alan Shieh <[email-masked]> wrote:

> Hi everyone,
> 
> I sometimes see packets stored out of order in pcap files that generated 
> by "tcpdump -i any" on kernel 2.4.26 with all packets arriving and 
> departing on an e1000 NIC. That is, the ordering by receive timestamp on 
> the packets is not the same as the ordering of the packets within the file.
> 
> In my precise scenario, packets of RX packets show up in the log 230 ms 
> later than they ought to based on the receive timestamp. The kernel 
> behavior (e.g., the packets that are sent by this node) seems to reflect 
> the arrival of the Rx packet at the position in the logfile, rather than 
> the arrival time according to the timestamp.
> 
> What are some of the known causes of this behavior? I'd like to know 
> what locks, etc. might be causing this processing / capture delay.

SMP or single CPU? What is the clock source being used?
If you had a CPU like dual-core AMD that doesn't sync TSC's and
that was the clock source, the timestamps could be wrong.