Wireshark-users: Re: [Wireshark-users] How does wireshark get "Time" shown in the listview?

From: Sake Blok <sake@xxxxxxxxxx>
Date: Thu, 5 Jun 2008 00:02:14 +0200

On Wed, Jun 04, 2008 at 10:35:04PM +0800, Xu nanxuan wrote:
> 
> My question is just like the title. Is the time consistent with the system time that is shown in the Taskbar of Windows OS?
>  
> And another question: Take the folollowing two lines for example:
>  
> ==========================
> time1 server->client packetinfo1
> time2 client->server packetinfo2
> ==========================
>  
> If the wireshark is installed on the client side, then it's easy to understand how time1 can be captured:when packet arrives at client, the wireshark record the time1 in some way. 
>  
> However, how does wireshark know time2? time2 means that the packet arrives at server at time2, but wireshark is installed on client, how does it know time2 which should be a system time of the server side?


See: http://wiki.wireshark.org/Timestamps

Cheers,
    Sake