With Ethereal on Windows 2000 server, I get horrendously bad frame arrival
times in my captures. In fact, despite the fact that the system clock (for
the OS and BIOS) shows the correct time, Ethereal reports a seemingly random
time and runs with it. Even worse still, is that although my capture
session may last 2 minutes real time, the frame arrival times can differ by
hours. The delta is also affected by this (obviously). This behavior is
consistent with winpcap 2.2 and 2.3. I tried going back a few versions to
Ethereal (0.8.19), WinPcap (2.1). Still the same result.
Here is a snippet of my last capture (Ethereal 0.8.19, WinPcap 2.1) keep in
mind that the duration of this capture was not more than 2 minutes and the
capture was started at 1015am eastern time:
******************************************************************
Frame 1 (60 on wire, 60 captured)
Arrival Time: Jun 27, 2002 14:23:12.1086
Time delta from previous packet: 0.000000 seconds
Time relative to first packet: 0.000000 seconds
...
<snip>
...
Frame 1689 (1514 on wire, 1514 captured)
Arrival Time: Jun 27, 2002 14:43:13.1211
Time delta from previous packet: 0.244473 seconds
Time relative to first packet: 1201.012532 seconds
Frame 1690 (1514 on wire, 1514 captured)
Arrival Time: Jun 27, 2002 15:03:13.6415
Time delta from previous packet: 1200.520335 seconds
Time relative to first packet: 2401.532867 seconds
Frame 1691 (1514 on wire, 1514 captured)
Arrival Time: Jun 27, 2002 15:43:14.6821
Time delta from previous packet: 2401.040676 seconds
Time relative to first packet: 4802.573543 seconds
Frame 1692 (1514 on wire, 1514 captured)
Arrival Time: Jun 27, 2002 17:03:16.7635
Time delta from previous packet: 4802.081352 seconds
Time relative to first packet: 9604.654895 seconds
Frame 1693 (1514 on wire, 1514 captured)
Arrival Time: Jun 27, 2002 19:23:21.0622
Time delta from previous packet: 8404.298669 seconds
Time relative to first packet: 18008.953564 seconds
...
*****************************************************
With exception of the first frame I have listed, the frames are contiguous.
Ethereal has worked quite well for me on Windows 2000 Workstation, RH Linux
7.2, Win98SE. For some reason, I've only had this issue with Windows 2000
Server. Any insight?
TIA
--------------------------------------------
Gregory Cox
coxg1@xxxxxxxxxx
