Hi All, We are doing some experiment, where we are trying to measure the processing time taken by a node when a packate pssess throgh it. --------eth0[Linux-PC Router]eth1------- We run tethereal/tcpdump(both use libcap) within this PC at eth0(incomming interface) and eth1(outgoing interface) . Then we find out our packate in both the captures and the difference of two captures gives processing time of the node Now, the question: Is doing so a right way to measure the processing time, as we are not sure where exactly does libcap captures the packates. Is it right before network driver or after it ao anywhere else? I just came to know that On Linux, libpcap captures packets using PF_PACKET sockets (or, on 2.0 kernels or with libpcap built on a 2.0-kernel system, PF_INET/SOCK_PACKET sockets). Any help on this issue will be highly appreciable. Thanks, Nitin __________________________________________________ Do you Yahoo!? Yahoo! Mail Plus - Powerful. Affordable. Sign up now. http://mailplus.yahoo.com -- Kernelnewbies: Help each other learn about the Linux kernel. Archive: http://mail.nl.linux.org/kernelnewbies/ FAQ: http://kernelnewbies.org/faq/