I just started using wireshark and have a very basic question about elapsed time and how time is measured in ws.
I've searched the user's manual & list archives, but apparently not well enough.
I set up a capture to run for 60 seconds. The capture starts & then stops after a minute, which is what I expected.
When I bring up the Statistics -> Summary window, it shows the elpased time as roughly 10 seconds. (I've tried this several times). The traffic during these tests is constant, and continues for 60 seconds, it's not like there is only 10 seconds worth of traffic and 50 seconds of idleness during the minute.
When I look at the times of the packets as shown in the Time column of the Main Window. it also shows a time of about 10 secs for the last packet.
Can someone explain why the elapsed time displayed (~10 sec) doesn't match the full time of the capture (60 secs)?
If there was a total of 60000 bytes trasferred during that 60 second period, shouldn't the Avg bytes/sec be 60000/60=1000 bytes/sec rather than 60000/10=6000 bytes/sec, which is what is displayed?
This seems like something fundamental, apologies for missing the point.
Thank you.
Windows Live™: Keep your life in sync. Check it out.
|
