Wireshark-users: Re: [Wireshark-users] Capturing and merging files from different machines
Cheers, much better, thanks.
-----Original Message-----
From: Kevin Cullimore [mailto:kcullimo@xxxxxxxxxx]
Sent: 18 June 2008 15:14
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Capturing and merging files from
different machines
Chris Swinney wrote:
>
> Hi,
>
> I have taken a capture on two different machines from an in-line
> network tap (one to capture upstream, one to capture downstream data).
> I now need to merge these file, but when I ask Wireshark to merge them
> chronologically, it seems to merge them based on the initial time
> taken into the capture, not the actual capture time.
>
> I have tried to mitigate time differences by synching both machines to
> an NTP server, but of course both captures are themselves started a
> different times. How can I best accomplish what I want? I've had a
> look at mergecap (as well as the inbuilt merge facility as shown
> above), but am not sure if this will still do what I'm after.
>
> As a side note, is it possible to "shut up" the capturing machines
> from trying to send network traffic on the capturing interfaces
> (Windows XP/Vista), so in effect they just listen?
>
Unchecking network protocols associated with the interface suppresses
most of the traffic likely to interfere with a capture .
>
> Regards
>
> Chris Swinney
>
> */Tel - (01792) 411662/*
>
> */Email - swin@xxxxxxxxxxxxx <outbind://28/swin@xxxxxxxxxxxxx>/*
>
> 56 Dan-y-graig Rd
>
> Port Tennant,
>
> Swansea
>
> SA1 8LZ
>
>
------------------------------------------------------------------------
>
> _______________________________________________
> Wireshark-users mailing list
> Wireshark-users@xxxxxxxxxxxxx
> https://wireshark.org/mailman/listinfo/wireshark-users
>
