Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 1056] New: Timestamping seems to be broken

[bugzilla-daemon@xxxxxxxxxxxxx]

http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1056

           Summary: Timestamping seems to be broken
           Product: Wireshark
           Version: 0.99.2
          Platform: PC
        OS/Version: Windows XP
            Status: NEW
          Severity: Minor
          Priority: Low
         Component: Wireshark
        AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
        ReportedBy: aaron.isotton@xxxxxxxxxx


Hi,

(In reality this applies to Wireshark 0.99.3, not 0.99.2, but it isn't
available in the Bugzilla dropdown).

I'm using Wireshark to analyze some synthetic traces of a real-time protocol.
The packets in the trace are timestamped starting on January 1 1970 (timeval
with sec and usec == 0), and the frames arrive in the following pattern:

Frame 1: 0 us
Frame 2: 0 us
Frame 3: 250 us
Frame 4: 500 us
Frame 5: 500 us
Frame 6: 750 us
Frame 7: 1000 us
Frame 8: 1000 us
Frame 9: 1250 us
Frame 10: 1500 us
Frame 11: 1500 us
...

These timestamps are correctly displayed by Wireshark as 'arrival time'.

Since the first frame arrives at T = 0, the 'Time since reference or first
frame' should alway be equal to the arrival time. Mysteriously enough, this
happens for the first two frames, but all frames starting with #3 are offset by
250us, as follows:

Frame 1: 0 us
Frame 2: 0 us
Frame 3: 0 us
Frame 4: 250 us
Frame 5: 250 us
Frame 6: 500 us
...

Setting the time reference manually (Ctrl-T) does not help.


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.