Kernel-Level Packet Timestamping

In this lesson, you will learn how the Linux kernel captures high-precision entry and exit timestamps for network packets to measure latency with microsecond accuracy.

Why Software Timestamps Aren't Enough

When a packet arrives at your network interface card (NIC), it travels through the physical medium, the driver, and eventually into the kernel's protocol stack. If you rely solely on standard application-layer arrival times, you introduce "jitter"—the delay caused by the CPU scheduler, interrupt processing, and context switching. To get a true measurement of network latency, we must timestamp packets as close to the hardware as possible.

Hardware vs. Software Timestamping

Linux supports two primary methods for timestamping, controlled via socket options:

1. Software Timestamps: Generated by the kernel immediately after the packet enters the NIC driver (during the netif_receive_skb stage). This is better than application-level timing but still subject to interrupt latency.
2. Hardware Timestamps (HWTSTAMP): Generated by the NIC hardware itself at the moment the last bit of the packet hits the wire. This is the gold standard for precision, as it eliminates all OS-induced delays.

To request these, you configure a socket using setsockopt with the SO_TIMESTAMPING flag. Once enabled, the kernel attaches a struct scm_timestamping to the socket buffer (skb) metadata.

Implementation Snippet

When you receive data via recvmsg(), you can inspect the control messages to extract these timestamps:

struct msghdr msg;
struct cmsghdr *cmsg;
// ... setup message headers ...

// Receive packet and metadata
recvmsg(sockfd, &msg, MSG_ERRQUEUE);

for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg)) {
    if (cmsg->cmsg_level == SOL_SOCKET && cmsg->cmsg_type == SO_TIMESTAMPING) {
        struct timespec *ts = (struct timespec *)CMSG_DATA(cmsg);
        // ts[0] = Software, ts[1] = Transformed, ts[2] = Hardware
        printf("Hardware timestamp: %ld.%ld\n", ts[2].tv_sec, ts[2].tv_nsec);
    }
}

By comparing the hardware timestamp (the precise arrival time) with the local system clock, you can accurately calculate the "wire-to-socket" latency, allowing for fine-tuned performance profiling in high-frequency trading or distributed systems.

Key Takeaway: Kernel-level timestamping allows you to bypass OS-induced jitter by capturing packet timing directly at the NIC hardware or the earliest driver entry point, enabling true network latency analysis.