Wireshark · Wireshark-users: Re: [Wireshark-users] Capturing and merging files from different machines

[Kevin Cullimore <kcullimo@xxxxxxxxxx>]

Chris Swinney wrote:
> Hi,
>
> I have taken a capture on two different machines from an in-line 
> network tap (one to capture upstream, one to capture downstream data). 
> I now need to merge these file, but when I ask Wireshark to merge them 
> chronologically, it seems to merge them based on the initial time 
> taken into the capture, not the actual capture time.
>
> I have tried to mitigate time differences by synching both machines to 
> an NTP server, but of course both captures are themselves started a 
> different times. How can I best accomplish what I want? I’ve had a 
> look at mergecap (as well as the inbuilt merge facility as shown 
> above), but am not sure if this will still do what I’m after.
>
> As a side note, is it possible to “shut up” the capturing machines 
> from trying to send network traffic on the capturing interfaces 
> (Windows XP/Vista), so in effect they just listen?
Unchecking network protocols associated with the interface suppresses 
most of the traffic likely to interfere with a capture .
> Regards
>
> Chris Swinney
>
> */Tel - (01792) 411662/*
>
> */Email - swin@xxxxxxxxxxxxx <outbind://28/swin@xxxxxxxxxxxxx>/*
>
> 56 Dan-y-graig Rd
>
> Port Tennant,
>
> Swansea
>
> SA1 8LZ
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> https://wireshark.org/mailman/listinfo/wireshark-users
>