Problems with External NIC’s
The timestamp provided by the external NIC’s is not very precise because the captured packets have to traverse through the USB cable until they reach the host kernel. Since the incoming packets are timestamped when they are processed by the kernel, therefore this makes the timestamp with external NIC’s inaccurate.
Time Stamps in Wireshark
A timestamp is a sequence of characters that determines when a certain event occurred, usually the date and time of day and even accurately to a small fraction of a second. When we capture packets in Wireshark, each and every packet is time-stamped and saved to the capture file, so that it can be used for further analysis. The packets get their timestamp from the libpcap (Npcap) library. The host kernel provides the system’s time to the libpcap library.