On Wed, 27 Aug 2008 14:54:12 +0200
Andi Kleen [off-list ref] wrote:

Evgeniy Polyakov [off-list ref] writes:

quoted

Yup, this innocent toys can end up with this such behaviour on modern
highly loaded machines.

I and also other people had some patches to move the time stamp
measuring into the socket. This way the time stamping didn't need to
be enabled on all packets, only on those that actually end up at a
socket that requires the time stamp.

Unfortunately DaveM didn't like it because some bank wanted
different semantics, see the discussion in 
http://thread.gmane.org/gmane.linux.network/91679

Perhaps you can find out which bank it was and send them a bill for
your CPU time ;-)

-Andi

Look at /proc/net/ptype to see if any AF_PACKET sockets are open.
There are several causes of this:
   * Applications like DHCP use AF_PACKET when they could use something else
   * AF_PACKET API was poorly designed and always has timestamps
   * The choice was made to get more accurate timestamps by stamping early in
     receive code. A better alternative would be to do it in protocol handler
     after the socket filter. Sorry, Andi socket layer is too late.
   * No driver is using hardware mechanisms to get accurate/free timestamps.
     I was working on sky2, but never was stable/complete.

Easist advice now is to fix userspace.