Wireshark-dev: Re: [Wireshark-dev] How does tshark "synchronize" multiple interfaces?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 6 Feb 2018 10:43:38 -0800
On Feb 6, 2018, at 8:39 AM, S. Jacobi <sjacobi@xxxxxxxxxxxxxxxx> wrote:

> I wasn't able to spot this mechanism in the code,

That's because it's not in the code, which would certainly explain why you're getting packets out of order.

So dumpcap needs to sort packets by time stamp before writing them to the capture file if it's capturing from multiple interfaces.