Wireshark · Wireshark-users: Re: [Wireshark-users] Capturing and merging files from different machines

["Chris Swinney" <swin@xxxxxxxxxxxxx>]

Thanks. I have looked at the traces, one taken from XP, the other from
Vista. The time difference is  around 2.5 seconds!!!!! This is why I
thought the traces were not being merged properly. 

I will attempts to compensate as suggested by Sake.

Chris 

-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxxxx] 
Sent: 18 June 2008 23:17
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] Capturing and merging files from
differentmachines


On Jun 18, 2008, at 2:13 PM, Chris Swinney wrote:

> I may have miss read the merged file. I'm not sure if the merged  
> file is totally correct as I seem to be getting responses before  
> requests, but they DO appear to be in chronological order. I'm not  
> sure at which point the time stamp is applied to the packet and if  
> the sniffing PC's have any effect on this - I think not. I assume  
> that the time stamp is applied to the header by whatever device sent  
> the packet, not by a device listening.

No.  The time stamps Wireshark gets from libpcap/WinPcap when it's  
capturing are the time stamps libpcap/the user-mode WinPcap code get  
from the OS's native capture mechanism/the WinPcap driver; from the  
point of view of libpcap/WinPcap, packets are time-stamped when they  
are *received*, not when they are *sent*.

Note also that the time stamp value comes from the clock's value at  
the time the time-stamping code runs; that could be after the packet  
is received by the network adapter or provided to the network adapter  
by the host.  See the page Sake Blok mentioned in his message:

	http://wiki.wireshark.org/Timestamps