Wireshark · Wireshark-users: Re: [Wireshark-users] Comparing two pcap files for latency

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jan 31, 2011, at 3:20 PM, Martin Visser wrote:

As Guy has said, you can't use the absolute times unless you can
ensure the machines at each end are millisecond synchronized.

...and that the time stamps given to transmitted and received packets correspond to the times you're interested in.  If you care *only* about transit time on the network - e.g., the time from the point at which the first bit of the packet is put onto the first network hop and the time at which the last bit of the packet is received from the last network hop - then those time stamps almost certainly do *not* correspond to the times you're interested in.  If you care about latency *including network stack latency*, it might be better, although the time stamp applied to outgoing packets is probably later than the time at which the outgoing packet was initially handed to the network stack, and the time stamp applied to incoming packets is probably earlier than the time at which the incoming packet was handed up from the network stack.