Wireshark · Wireshark-users: Re: [Wireshark-users] Capturing and merging files from different machines

[Guy Harris <guy@xxxxxxxxxxxx>]

Chris Swinney wrote:

> I have taken a capture on two different machines from an in-line network 
> tap (one to capture upstream, one to capture downstream data). I now 
> need to merge these file, but when I ask Wireshark to merge them 
> chronologically, it seems to merge them based on the initial time taken 
> into the capture, not the actual capture time.

What do you mean by the "initial time taken into the capture" and "the 
actual capture time"?

> As a side note, is it possible to “shut up” the capturing machines from 
> trying to send network traffic on the capturing interfaces (Windows 
> XP/Vista), so in effect they just listen?

Turning name resolution off in Wireshark might help, but that only 
limits what Wireshark does on the network, not what anything else 
running on the machine does on the network.  I don't know whether 
network interfaces can be configured "down" on Windows, or whether 
WinPcap will recognize interfaces configured "down" so that you can 
capture on them.