WinPcap synchronizes with the system time only when at the beginning of a
capture. More precisely, it syncs when you start a capture only if there are
no other captures (on the same adapter or different adapters) running. As a
consequence, adjustments to the clock done by NTP are not seen.
Have a nice day
GV
--------------------------------------------------
From: "Guy Harris" <guy@xxxxxxxxxxxx>
Sent: Thursday, January 14, 2010 10:25 AM
To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
Subject: Re: [Wireshark-users] Timestamp Skew
On Jan 14, 2010, at 10:19 AM, Lee Riemer wrote:
The sniffer server is syncing with NTP, and this is also a dual core
system. You may be on to something, though. If the box is correcting
it's skew with NTP, wireshark might not be if it isn't polling the time
for each packet.
Anyone know exactly how WS picks the time to stamp?
On Windows, it takes it from the information supplied to it by WinPcap, so
it's not Wireshark that's picking the time to stamp, it's WinPcap. (On
UN*X, it takes it from the information supplied to it by libpcap, which
is, on almost all platforms, the time supplied to libpcap by the OS-native
packet capture mechanism being used by libpcap.)
If none of the WinPcap developers reply here, you might want to report it
to them as a bug:
http://www.winpcap.org/bugs.htm
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
