I have it set for "seconds since previous captured packet" and and I filtered the PVST+packets. I was trying to the same thing I saw while viewing a wireshark university training session.
On Thu, Dec 31, 2009 at 4:40 PM, Martin Visser
<martinvisser99@xxxxxxxxx> wrote:
How are you displaying the "delta time"? If you are changing the standard time display format, there are two options, one for the difference to the preceeding *displayed* packet and the other for the preceeding *captured* packet. (You clearly have a display filter enabled as your packet numbers are not consecutive)As I am very doubtful a Cisco router will send PVST+ BPDUs in intervals as short as say 5ms (packet 495) then it must be captured packets, as the delta displayed would be the difference from the previous packet (494) that isn't being displayed. So the packet 6573 you highlighted is probably just showing a relatively quiet time on your network - lots of activity between packet 6475 and 6572 and then nothing for 467ms. I am guessing that your PVST+ BPDU interval is probably around 1 second, to show this, change the time display format to the previous displayed format.
I think you find you have a similar problem when you are say just displaying ARPs, particular as ARP requests will occur for all intents at random intervals (based on when the application initiates a connection to previously unknown (or at least forgotten) IP address.
Regards, Martin
MartinVisser99@xxxxxxxxx
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
