Assuming the clocks are stable (not drifting) then you would expect the offset across the two traces to be constant.
If the two traces have related (or even the same traffic) and you know the approximate delay time across the network then just use this as well as the offset you see between the same (or associated packets)
Regards, Martin
MartinVisser99@xxxxxxxxx
On Thu, Mar 25, 2010 at 1:20 AM, Frank Schuster
<frank.schuster01@xxxxxx> wrote:
Yes, the start time is different but is there an easy way to synchronize both?
I can calculate the difference but that is not really fun :)
But if it the only way it is ok....
Frank
>On 24 mrt 2010, at 14:18, Frank Schuster wrote:
>
>> I want to merge two files into one file, no append!!!
>> Both files begin at timestamp 0.0000s.
>
>I assume that the relative timestamps in each file begin at 0.00s. Mergecap does the merging based on the absolute timestamp in the tracefiles, which makes more sense.
>
>What is the output of the command "capinfos -Tae firstfile.cap secondfile.cap"?
>
>> I tried this command:
>> mergecap -w outputfile.pcap firstfile.pcap secondfile.pcap
>>
>> But I get an mergefile, where the firstfile.pcap is the first one and between the files are a pause of 17 seconds.
>>
>> What I do wrong, why it didn't merge?
>
>I assume both files were made on different systems and that the clock on these systems were not synchronized. You should compensate for the difference by using "editcap -t". You can find a presentation on how to do that at
___________________________________________________________
GRATIS für alle WEB.DE-Nutzer: Die maxdome Movie-FLAT!
Jetzt freischalten unter
http://movieflat.web.de
___________________________________________________________________________
