title: how pcap header are being set?
body: <p>Context:
  I am writing a sniffer to measure the TCP RTT ( round Time Trip ) between SYN-ACK -> ACK .
  The idea is to have the time that it takes since SYN-ACK packets to get back with a ACK packet.</p>
  
  <p>Problem:</p>
  
  <p>The problem is that, sometimes I get negative RTT or very bad measurement due to the way I am calculating the RRT.</p>
  
  <p>So,  RTT =  SYN-ACK pcap_timeval   - ACK pcap_interval</p>
  
  <p>Question:</p>
  
  <p>1) How the timestamp are being set on the pcap headers ?
  2) Is there a better way to get the RTT measurement?
  3) Could it be possible that the kernel has a timing bug when setting the pcap header?
  4) I would like to know how exactly this pcap_timeval is being set.  Any idea where to look? or any other ideas?</p>
  
  <pre><code>struct pcap_timeval {
   bpf_int32 tv_sec;           /* seconds */
   bpf_int32 tv_usec;          /* microseconds */
   };
  
  
  struct pcap_sf_pkthdr {
   struct pcap_timeval ts;     /* time stamp */
   bpf_u_int32 caplen;         /* length of portion present */
   bpf_u_int32 len;            /* length this packet (off wire) */   
  };
  </code></pre>