Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Packet capture point

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 26 Apr 2009 11:28:06 -0700

On Apr 26, 2009, at 11:23 AM, Guy Harris wrote:

dev_queue_xmit_nit() is called before the device's hard_start_xmit
routine is called.  That probably means the packet is handed to
libpcap at about the time that it's transmitted.

Or, more precisely, at the time the driver gets told to transmit it. That is, of course, not necessarily the time the hardware actually puts the packet on the {wire,air}.