On 4/5/2010 11:10 PM, Andrej van der Zee wrote:
Hi,
I was wondering if it is possible to match packets at the sender and
receiver end of the connection. Suppose I have two cap-files for the
same period between hosts A and B that communicate with each other,
can I match packets that are send from A to B, as the packets are
sniffed at both sides of the line?
It partially depends upon the nature of the traffic. Simple cases
wherein the data is encapsulated via tcp AND ip allow you to infer which
interface sent the traffic and additionally allow you to infer
temporality-tracking differences between hosts by matching up timestamps
and sequence numbers. Other packet-formatting combinations may provide
fewer data-points for you to utilize while engaging in the measurement
exercises you indicated interest in. I'd be interested to hear if
anyone's successfully made use of protocol-independent techniques.
One of the problems I am trying to solve is to detect time differences
between the two hosts, preferably on a per-second basis in case of
possible clock skews. I thought maybe I could compare the timestamps
at host A and B for the same packets, as a starting point.
Any help would be appreciated.
Thank you,
Andrej
___________________________________________________________________________
Sent via: Wireshark-users mailing list<wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
