Ethereal-users: Re: [Ethereal-users] Decoding of new NAI sniffer timestamps.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "James V. Fields" <jvfields@xxxxxxx>
Date: Wed, 12 Jan 2005 05:58:47 -0500
Hi David -

We have a fix going into the next release of Ethereal that should help
properly interpret the elapsed time between packets, which is how the
Sniffer actually marks time (the only absolute time in the capture will
be to mark the start of the trace).  This "fix" has been tested with a
good many capture and seems to work especially well for traces taken
with newer Sniffers, but we obviously don't have all of them to play with.

There are automated nightly builds of Ethereal containing the newest
code to allow for testing before each official release.  You can
download one by following the "Development" link from
http://www.ethereal.com and looking in the section marked "Automated
Builds."

Starr, David wrote:

We just installed some new NAI sniffers and when I pull up the output (.cap
file) in etheral, the timestamp appears to be off by a factor of
1/3.........  I run a capture for approx 30 minutes (32 meg file)
Timestamp in etheral show 600 seconds as the last packet time.  Also, the
frame date/time is not decoded correctly.......

Is there a setting I need to change????  I'm running 0.10.8..

Thanks,
Dave

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users