Wireshark · Ethereal-dev: RE: [Ethereal-dev] Plugin for making RTP analysis

["Jonmejoy DasChoudhury" <jonmejoy@xxxxxxxxxxxxxx>]

Hi,

In an RTCP SR packet sniffed by ethereal, I see values like 350180 in MSW and 360710144 in LSW of NTP Timestamp fields. The source of these packets is MS Netmeeting, transmitting G.723 encoded RTP payloads. Whereas ethereal packet header timestamp value is much larger (sniff time at receiver which is also running Netmeeting peer; I assume it is UTC, units secs and microsecs since Jan 1 1970).

Questions:
How to determine the relationship between the NTP timestamp in packet and the sniff times? I have NTP synchronized clocks of both receiver/sender NT Win2K machines.
Does the NTP-UTC offset 2208988800UL come in to play and if so how to apply it to arrive at the correct relationship?

I am desperate for setting my thought in the right direction. I will appreciate any help greatly.


Regards,
Jonmejoy