This is our old Q&A Site. Please post any new questions and answers at

In some of the traces (taken by tcpdump) the packet order (sorted by packet number) is not always same as the timestamp order, any reason this would happen?

asked 23 Oct '16, 23:09

yhzs8's gravatar image

accept rate: 0%

Is timestamp part of a protocol header?

(23 Oct '16, 23:15) koundi

No, timestamp is generated by the capturing hardware/software. Do you capture on only one interface or more?

(24 Oct '16, 05:10) sindy

@Luffy: No I didnt mean the "TCP option Timestamp", rather the "time" field shown on the Wireshark for each packet.

@Sindy: No, it was just taken on a single interface.

(25 Oct '16, 13:38) yhzs8

On what OS is tcpdump running?

(25 Oct '16, 23:19) Guy Harris ♦♦

It is taken on Linux, SUSE

(26 Oct '16, 14:07) yhzs8

At least some versions of Linux, when running on a multiprocessor machine - which means any multi-core machine - may process two packets on different CPU cores, and the first packet to arrive may take longer to process, for whatever reason, than the second packet to arrive, and therefore the second packet may be queued up on a socket before the first one is.

tcpdump and Wireshark capture traffic using the libpcap library, and libpcap uses PF_PACKET sockets on Linux, so libpcap may, therefore, see the second packet before the first packet; libpcap just presents packets to the application as they arrive, without sorting them by the time stamp, and both tcpdump and Wireshark write out packets as they arrive, without sorting them by the time stamp.

permanent link

answered 26 Oct '16, 14:23

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

So if the traces is based on the socket-queue-ordering, there must be another entity that "timestamps" the packets which timestamps them differently than the socket-queue-ordering, which entity is it?

(27 Oct '16, 01:12) yhzs8
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 23 Oct '16, 23:09

question was seen: 3,208 times

last updated: 27 Oct '16, 01:12

p​o​w​e​r​e​d by O​S​Q​A