Wireshark · Ethereal-dev: Re: [Ethereal-dev] Wrong decoding of tektronix K15 Gb file

[LEGO <luis.ontanon@xxxxxxxxx>]

Hi,

On 8/10/05, Yann Samama <ysamama@xxxxxxxxxx> wrote:
> 1/ The numbers of packets and the packets themselves seen by Ethereal
> and the K15 viewer are different.
>  => K15 viewer sees 257 packets (from 7 to 263, see enclosed file
> k15.jpg).
>  => Ethereal sees 147 packets (from 1 to 147, see enclosed file
> ethereal.jpg).

Could you send in the k15's text output for the capture file you
attached. Please make sure to to set the display of the packet's hex
data.

> 2/ The statistics for GSM/A-Interface DTAP/GPRS Session Management
> wrongly displays 0 for all counters from time to time.
I think that should be a problem of the tap not related to the file format.

> 3/ The start timestamp read by Ethereal differs from the one read by the
> K15 viewer.
>  => K15 : 03/08/2005 22:50:20,907,373
>  => Ethereal : 04/08/2005 00:50:20,907,373
>  => So there is a 2 hours shift ; since those traces were taken in a
> country which time is GMT+2, I would suggest that there is some field
> holding the shift value wrongly taken into account?

I'I don't  even know if there is timezone data in a file. I thought it
always was GMT as in some captures I got.
 
I'd need a set of very similar captures (same scenario, sources,
stacks, etc.) taken using different timezone configurations to be able
to dig into this.

-- 
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan