https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5580
Summary: Incorrect time differences displayed with time
reference set
Product: Wireshark
Version: 1.5.x (Experimental)
Platform: x86
OS/Version: Windows Vista
Status: NEW
Severity: Normal
Priority: Medium
Component: Wireshark
AssignedTo: wireshark-bugs@xxxxxxxxxxxxx
ReportedBy: Jim@xxxxxxxxxxxxxxxxx
Created an attachment (id=5723)
--> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5723)
Trace file of http browsing session that exhibits the time display problem.
Build Information:
Version 1.5.0-SVN-35512 (SVN Rev 35512 from /trunk)
Copyright 1998-2011 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (32-bit) with GTK+ 2.16.6, with GLib 2.24.2, with WinPcap (version
unknown), with libz 1.2.3, without POSIX capabilities, without libpcre, with
SMI
0.4.8, with c-ares 1.7.1, with Lua 5.1, without Python, with GnuTLS 2.8.5, with
Gcrypt 1.4.5, with MIT Kerberos, with GeoIP, with PortAudio V19-devel (built
Jan
12 2011), with AirPcap.
Running on 32-bit Windows Vista Service Pack 2, build 6002, with WinPcap
version
4.1.2 (packet.dll version 4.1.0.2001), based on libpcap version 1.0 branch
1_0_rel0b (20091008), GnuTLS 2.8.5, Gcrypt 1.4.5, without AirPcap.
Built using Microsoft Visual C++ 9.0 build 30729
--
OVERVIEW
I have Wireshark's Time column formatted to show “Seconds Since Beginning of
Capture.” I have added the built-in Delta Time Displayed column. Under this
configuration, when a Time Reference is set on a packet, the immediately
following displayed packet should show the same value in the Time column and in
the Delta Time column. However, sometimes these columns show different values,
at least one of which has to be incorrect.
TO RE-CREATE
Set the regular (“format as specified”) Time column to “Seconds Since Beginning
of Capture.” Add another time column for Delta Time Displayed. Load the
attached trace file, “Delta Times.pcap.” Apply an “http” display filter. The
first six displayed packets will be packet numbers 5, 7, 8, 10, 11 and 13. The
Delta Time between packets 8 and 10 is 0.003662 seconds. Highlight packet 8 and
set it as a time reference. Look at the time values for packet 10, the next
displayed packet. The Time column will show 0.003662, which is correct. The
Delta Time column will now show 0.003434, which is not correct. 0.003434 is the
delta time between packet 9, which is not displayed, and packet 10.
Clear the time reference and clear the display filter. Highlight packet 188 and
select “Follow TCP Stream.” Click “Close” to close the “Follow TCP Stream”
dialog but leave the display filter in place. Highlight the first displayed
packet, packet 188, and set it as a time reference. The next displayed packet,
#196, will show 0.060335 seconds in the Time column, which is correct and
0.001564 seconds in the Delta Time column, which is not correct. 0.001546 is
the delta time between packet 195, which is not displayed, and packet 196.
This incorrect delta time display only seems to occur when the Time Reference
packet and the next displayed packet are not contiguous because a display
filter is causing one or more intermediate packets to be hidden.
This display problem is also seen in the PortableApps version.
The display behavior was slightly erratic, and I did not always get identical
results when following identical steps.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
