In article <47F3C839.7080808@xxxxxxx> you wrote: > tcpdump is always working in promiscous mode I think: > Apr 2 13:02:27 192.168.1.99 kernel: device eth0 entered promiscuous mode Unless you pass it the -p option. However promisc mode does not mean it bypassses more/less network stack code. The hooks for the package capturing are still early in the input processing, but still after all the Interrupt/Queueing code which can potentially drop or delay packets. However I think its a sign that it is not in the TCP path but below. Gruss Bernd -- To unsubscribe from this list: send the line "unsubscribe linux-net" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
