On Apr 26, 2009, at 10:31 AM, Jacek Tranczewski wrote:
I'm using Linux Debian 2.6.26-1-686
The routine in 2.6.26.5 (and probably other recent versions of Linux,
and older versions going back to some degree) that "wraps around"
outgoing packets for capture is dev_queue_xmit_nit() in net/core/
dev.c. It's called from dev_hard_start_xmit(), which is called from
dev_queue_xmit() for devices with no queue and qdisc_restart(), called
from __qdisk_run, called from qdisc_run(), for devices with a queue.
dev_queue_xmit_nit() is called before the device's hard_start_xmit
routine is called. That probably means the packet is handed to
libpcap at about the time that it's transmitted.
