Timestamping data received by monitoring system in nfv

A method for monitoring a plurality of virtual machines communicatively coupled to a virtual switch with a plurality of virtual Network Interface Cards (vNICs) using a monitoring virtual machine communicatively coupled to the virtual switch, the method comprising:

• mirroring, by the virtual switch, a plurality of data packets exchanged between two communicating monitored virtual machines to a vNIC associated with the monitoring virtual machine;
• retrieving, by the monitoring virtual machine, the plurality of mirrored data packets from the vNIC associated with the monitoring virtual machine;
• and
• generating, by the monitoring virtual machine, timestamps indicative of packet arrival time at the virtual switch for each data packet in the retrieved plurality of mirrored data packets based, at least in part, on a computed base time.

A monitoring system comprising:

• a plurality of host computers executing a plurality of virtual machines;
• a virtual switch with a plurality of virtual Network Interface Cards (vNICs), wherein each vNIC of the plurality of vNICs is associated with a virtual machine of the plurality of virtual machines;
• and
• a monitoring host computer executing a monitoring virtual machine having a packet capture Application Program Interface (API), the monitoring virtual machine coupled to the virtual switch, wherein the virtual switch is configured to mirror a plurality of data packets exchanged between two communicating virtual machines to a vNIC associated with the monitoring virtual machine and wherein the monitoring virtual machine is configured and operable to:
• retrieve the plurality of mirrored data packets from the vNIC associated with the monitoring virtual machine;
• generate timestamps indicative of packet arrival time at the virtual switch for each data packet in the retrieved plurality of mirrored data packets based, at least in part, on a computed base time;
• and
• periodically adjust the computed base time by calculating a time difference between its internal current time and a system time received from the external time source, wherein the internal current time is derived from the computed base time.