In a full hardware solution, as much of the monitoring system is carried out on the custom interface, and use the system for storage and formatting of the data. Ideally the packet will be timestamped as soon as it has arrived on the card, before any buffering or queuing takes place.
Clock synchronisation is important if there are multiple interfaces in a machine.
As discussed in section 3.2.1 if packets are being captured by two interfaces, the timestamps need to be consistent between interfaces. In a hardware system, a check can be placed on any buffers to detect packet loss. A hardware solution will not necessarily be perfect, but a well designed system will be able to provide a definite counter of any drops that have occurred in the system. For this reliability to carry through to the final network trace, checks must be placed at every point in the system that packet loss can occur. This includes any software components that run on the host PC to deal with the storage of the data as it is delivered by the monitor card.