Ethereal-users: Re: [Ethereal-users] Re-assembling half duplex streams

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Sat, 9 Nov 2002 00:43:24 -0800
On Fri, Nov 08, 2002 at 06:48:40PM -0500, Chris Rapier wrote:
> > It would probably work better if the time stamps in the two capture
> > files on each of the ports were synchronized.
> 
> That may prove tricky depending on how much clock drift there is. CAIDA 
> and Waikato in NZ have done a lot of this sort of thing but they made 
> use of GPS syncs which I don't have access to (being that I can't 
> squeeze any more money out of the budget at this point).

Well, as long as the time stamps don't drift *so* much that you see
replies before requests, it probably won't be too bad a problem.   If
they do, a number of dissectors won't be able to dissect as much as they
could if the request came before the reply in the capture.