Online application layer processing of network layer timestamps

A method of providing network layer data to application layer components of a network protocol stack that implements a multi-layer communication model, the method comprising:

• receiving, by a processor executing a process on an application layer, from a lower layer of the multi-layer communication model, first message payload data relating to a first message;
• receiving, by the processor, from the lower layer of the multi-layer communication model, second message payload data relating to a second message;
• obtaining, by the processor, a first network timestamp originally inserted, at a data link layer of the multi-layer communication model, into a first network header by a network switch to indicate a first time at which first bytes relaying the first message were received at the network switch over a physical link,
• the first network header and the first network timestamp having been removed as the received first bytes are propagated up the multi-layer communication model from the data link layer;
• obtaining, by the processor, a second network timestamp originally inserted, at the data link layer of the multi-layer communication model, into a second network header by the network switch to indicate a second time at which second bytes relaying the second message were received at the network switch over the physical link,
• the second network header and the second network timestamp contained in the second network header having been removed as the received second bytes are propagated up the multi-layer communication model from the data link layer;
• and
• determining, by the processor, an order of the first message and the second message based on the first network timestamp indicating the first time at which the first bytes relaying the first message were received at the network switch over the physical link and the second network timestamp indicating the second time at which the second bytes relaying the second message were received at the network switch over the physical link.

A network layer capture device, comprising a hardware processor programmed with one or more instructions to:

• receive, from a network switch, data relating to a message;
• obtain a network timestamp originally inserted, at a data link layer of a multi-layer communication model, into a first network header by the network switch to indicate a first time at which first bytes relaying the message were received at the network switch over a physical link,
• the first network header and the network timestamp having been removed as the received first bytes are propagated up the multi-layer communication model from the data link layer;
• generate payload data for an application layer of the multi-layer communication model based on the data from the network switch while retaining the network timestamp, wherein the payload data is generated separate from a network protocol stack that also generates its version of the payload data for the application layer;
• generate a hash of at least some of the payload data using a cryptographic hash function;
• and
• transmit the hash and the network timestamp to the application layer, the hash being used to match the network timestamp with the version of the payload data from the network protocol stack.