Explain the difference between what a software timestamp and a NIC hardware timestamp measure on a received packet, and describe how you would use both together to prove that a 20 microsecond spike happened in your process rather than on the network.

Explain the difference between what a software timestamp and a NIC hardware timestamp measure on a received packet, and describe how you would use both together to prove that a 20 microsecond spike happened in your process rather than on the network.

Approach: Identify the point on the path at which each timestamp is taken, then take the difference between the pair and attribute the gap.

A hardware timestamp is taken by the NIC as the packet crosses the wire and a software timestamp is taken by code after delivery, so their difference is exactly the host's own receive path and a spike in that difference is yours. The NIC stamps against its own oscillator, which PTP disciplines to the grandmaster to within tens of nanoseconds, which PTP clock synchronisation holds to the grandmaster, and the stamp is unaffected by anything happening in the operating system. The software stamp is taken by your handler and includes DMA, descriptor polling or interrupt delivery, any scheduling delay and every cache miss between arrival and the read. Latency attribution then follows from logging both stamps for every packet and plotting the difference. If the 20 microsecond spike appears in that difference the packet was on the box the whole time and the cause is local: a page fault, a preemption, a C-state wake, a garbage collection pause or a cache eviction, and you narrow it with per-core counters. If the difference is flat and the spike is instead in the gap between consecutive hardware stamps, the packet arrived late from the network and you look at switch queueing or the sender. Sequence numbers plus exchange-side send timestamps close the loop upstream of your NIC.

Follow-up: PTP disciplines the NIC clock but your application reads CLOCK_REALTIME from the host. What error does that introduce and how do you keep the two consistent?

Key concepts: hardware timestamp, software timestamp, clock synchronisation, latency attribution.