two instances of tcpdump at the same time?

Question

Are there any known problems in running two instances of tcpdump at the same time on the same network interface (with non-conflicting filters)?

I'm experiencing some weird timestamping and I thought that that could be the cause.

Answer 1

packet filtering is usually done in the kernel so it shouldn't cause any missed packets or out of order packets in each tcpdump process. If you're comparing the two different tcpdumps and seeing the slightly off time stamps I could see a couple of reasons for that but it's hard to say without knowing what specifically the issue is you're having.