Wireshark · Ethereal-users: Re: [Ethereal-users] Network Traversal Time

[Ian Schorr <spamcontrol2@xxxxxxxxxxx>]

On Mar 9, 2004, at 3:28 PM, sstudsda@xxxxxxxx wrote:

> Using NTP to sync the capturing stations to a common time source should
> provide a consistent time for recording timestamps at each point.  Of
> course there could be some minor clock drift, but it should be accurate
> enough that the drift is not going to have a significant impact on the
> results.
I don't particularly like this option (or this as the only option) 
because even with the existence of tools like NTP, host clock 
synchronization can be problematic.

Especially in field service circumstances or others where using "fixed" 
network probes is difficult, network connectivity for a recording 
device is spotty/unavailable, etc, it can be difficult to ensure that 
clocks are very very tightly synchronized.

The other method is a bit more elegant IMO =)

> Hmm, looks like we have found our volunteer.  Now he just needs to 
> dust off
> his C programming books and start reading some source code.  =)

Ugh.  This requires the volunteer to have spare or dedicated time,  If 
we're waiting on me it will probably be 2005+ before this feature 
appears  =)

Ian