Where does Wireshark (libpcap) capture packets, in the NIC or kernel?

Question

Does Wireshark (libpcap) capture packets when they are still in the NIC or when they have been passed to the kernel?

I run a test program which waits for a message from a TCP connection using the recv function and then immediately respond using the send function. Then I measure the latency between the packet received and sent, which is measured by the time stamps shown in Wireshark. I found this latency varies a lot when I use different NICs. This seems to suggest that Wireshark captures the packets when they are still in the NIC, so that how fast the NIC processes the packet is reflected in the above latency. If the capture happens at the kernel, I can't explain why the latency is different when using different NICs as they are all using the (same) kernel network stack.

However, if the capture really happens in the NIC, how is this possible? How can libpcap somehow add some functionality of the NIC itself?

Answer 1

You have to assume that this capture cannot happen "in the NIC".
There is no common interface to every NIC; that's why every OS has to use device drivers to abstract the interface.You only specify the network interface (e.g. eth0) you want to use with Wireshark. You do not specify the manufacturer/model of the hardware or the name of the device driver.
So by simple logic one of your alternatives has to be wrong.

I've read about a method to receive the raw Ethernet frames before they are processed by the protocol stack. But the proper method to answer your question is to actually examine the GPL source code.

If the capture happens at the kernel, I can't explain why the latency is different when using different NICs as they are all using the (same) kernel network stack.

(You're not clear as to what "latency" you're calculating/measuring and how it varies.)

Apparently you have not considered that the method that Wireshark uses to capture frames can be completely separate from the method that timestamps the frames.
Linux supports both hardware and software generated timestamps of Ethernet frames.
The hardware timestamps would be generated by the network adapter.
The software timestamps would be generated by the Linux device driver.
Details are described in Documentation/networking/timestamping.txt

Bottom Line
Wireshark is a userspace application.
It can only utilize the capabilities that the OS offers through APIs.
Since timestamping of frames is intrinsic to the network subsystem, Wireshark is not obligated to perform its own timestamping, but rather utilize the existing capabilities of the OS.
Consequently Wireshark can "capture" raw network packets (with timestamps) using existing system calls.