I'm using BPF to obtain the transmit timestamp of packets I send. I noticed that the timestamps differed slightly between what I was seeing and what tcpdump saw. The cause of this is that timestamps are generated for each bpf fd if the packet passes the filter. The bpf(4) documentation is accurate for this case, but I'm wondering if it makes more sense to generate the timestamp once for each packet, as it allows a more accurate estimation of when the packet might have hit the wire. Fix: I took the liberty of optimising bpf_mtap a little while generating the patch. I also removed code for generating timestamps based on the kernel being run, as the code would be duplicated in two places. I'm happy to generate a macro and stick it in bpf_compat.h How-To-Repeat: Open two tcpdump sessions that capture the same packets. You'll notice the timestamps differ slightly.
Responsible Changed From-To: freebsd-bugs->dwmalone I've committed a patch to -current. I will MFC in about a month.
State Changed From-To: open->closed I merged this some time ago, but forgot to close the PR.