Wireshark · Wireshark-users: Re: [Wireshark-users] Packet capture point

[Guy Harris <guy@xxxxxxxxxxxx>]

On Apr 26, 2009, at 10:31 AM, Jacek Tranczewski wrote:

> I'm using Linux Debian 2.6.26-1-686

The routine in 2.6.26.5 (and probably other recent versions of Linux,  
and older versions going back to some degree) that "wraps around"  
outgoing packets for capture is dev_queue_xmit_nit() in net/core/ 
dev.c.  It's called from dev_hard_start_xmit(), which is called from  
dev_queue_xmit() for devices with no queue and qdisc_restart(), called  
from __qdisk_run, called from qdisc_run(), for devices with a queue.

dev_queue_xmit_nit() is called before the device's hard_start_xmit  
routine is called.  That probably means the packet is handed to  
libpcap at about the time that it's transmitted.