Wireshark · Ethereal-users: Re: [Ethereal-users] Timing on NAI sniffer captures

[Guy Harris <guy@xxxxxxxxxx>]

On Tue, Jun 04, 2002 at 06:56:44PM -0400, Chris Klomp wrote:
> Very interesting... >:-(

Yup.

See the thread that starts at

	http://www.ethereal.com/lists/ethereal-dev/200112/msg00131.html

and especially the message at

	http://www.ethereal.com/lists/ethereal-dev/200112/msg00158.html

where he says

	It is cannot be read by ethereal and by the same version of the
	sniffer(I mean NetXRay and Sniffer Pro).

which sounds to me as if there's one capture file written by a version
of the Sniffer software that cannot be read correctly by the *same*
version of the software running on a different machine.

It may be that the Sniffer software uses timers on the Ethernet card
itself, if the card is present, to get a more precise "time of arrival"
time stamp - but that it assumes that, at least for some capture files,
the time stamps of packets have the same resolution as they would have
had if they had been captured on the machine on which the Sniffer
software is running, *even though they weren't captured on that
machine*.