Wireshark · Wireshark-users: [Wireshark-users] Capturing and merging files from different machines

["Chris Swinney" <swin@xxxxxxxxxxxxx>]

Hi,

 

I have taken a capture on two different machines from an in-line network tap (one to capture upstream, one to capture downstream data). I now need to merge these file, but when I ask Wireshark to merge them chronologically, it seems to merge them based on the initial time taken into the capture, not the actual capture time.

 

I have tried to mitigate time differences by synching both machines to an NTP server, but of course both captures are themselves started a different times. How can I best accomplish what I want? I’ve had a look at mergecap (as well as the inbuilt merge facility as shown above), but am not sure if this will still do what I’m after.

 

As a side note, is it possible to “shut up” the capturing machines from trying to send network traffic on the capturing interfaces (Windows XP/Vista), so in effect they just listen?

 

Regards

 

Chris Swinney

 

Tel - (01792) 411662

Email - swin@xxxxxxxxxxxxx

 

56 Dan-y-graig Rd

Port Tennant,

Swansea

SA1 8LZ