Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Packet capture point

From: Jacek <cr4dl3@xxxxx>
Date: Sun, 26 Apr 2009 19:13:15 +0200
Thanks for answer but I'm not sure that's correct.

I made some test with 2 interfaces - 1st station sending packet, 2nd as wireless monitor capturing packets. 
Assuming that wireshark captures outgoing packets in driver (entering queue),  logging both interfaces gives me packet delay from entering queue to sending (received by monitor int).  Measured delays are ridiculously small comparing to theoretical delay in WLAN.

Can some confirm exact point (layer OSI) of capturing packet that are sent ?


Please help,
Jacek



Dnia 20 kwietnia 2009 20:48 Guy Harris <guy@xxxxxxxxxxxx> napisał(a):

> On Apr 20, 2009, at 10:44 AM, Jacek T. wrote:
> 
> > I'm trying to measure delay in 802.11 network and I need in witch  
> > layer (in out) packet are captured.
> > When capturing outgoing packets, do I get the time of packet  
> > entering 2nd layer (queue) or packet exiting queue?
> 
> It could depend on the operating system, but if you're capturing  
> traffic being sent by the machine on which you're doing the capturing,  
> the packets are probably delivered at the time the driver gets them,  
> not at the time they're transmitted.
> 
> Note also that the *receive* time stamp isn't necessarily accurate,  
> given that the packet is time stamped somewhere in the driver, which  
> might be some time after the packet is received by the network adapter.
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list 
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>              mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>