Wireshark-users: Re: [Wireshark-users] remote capture framework
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Morty <morty+wireshark@xxxxxxxxxx>
Date: Tue, 18 May 2010 01:34:22 -0400
On Thu, May 13, 2010 at 04:54:34PM -0700, Phil Paradis wrote:

> I'm not sure about the timestamp issue; all of our capture boxes are
> Windows-based, so I've never really played with a long-running
> capture on Linux.

How long did you have to leave it running before seeing the problem on
Windows?  I've left dumpcap running on a Linux box for 5 days, started
a big download, and am seeing minimal time differences.  Methodology:

dumpcap -w test.pcap -b filesize:1024 -b files:5 > /dev/null 2>&1 &
# wait 5 days
# kick off big download
tcpdump -nr $(ls -1rt *.pcap|tail -1)|tail -1; date +%H:%M:%S.%N

The delta between the tcpdump and the current date+time is about 10ms
on my box, which is about what it was when I kicked this off 5 days
ago.

Is 5 days long enough to prove that this isn't a problem under Linux,
or does it need to stay longer?

- Morty