Wireshark · Ethereal-users: Re: [Ethereal-users] mergecap screwing up timestamps

[Guy Harris <gharris@xxxxxxxxx>]

Edward Mazurek wrote:

> I have mergecap 0.10.4. I think it's the latest as I just downloaded it.

The latest is 0.10.7; some platforms might not have the latest version 
in binary form, so the one available for those platforms might be older, 
e.g. 0.10.4.

You might want to try 0.10.7, if you can.

> Anyone out there using mergecap to merge together trace files?
>
> I'm trying to merge together some trace files and it's screwing
> up the timestamps in the output file.
>
> For example:
>
> - In the output file the timestamps start @ 3:30AM then at around
> frame 350 the timestamps go to 2:19:05AM. The are supposed to be
> in chronological order.
>
> - Also, all of the records timestamps are not the same in the output
> file vs. what they were in the input file. I'm using the current
> ethereal to view both the input and output(merged) file.

What file formats are the input files?  Read the file into Ethereal, 
select "Summary" from the "Statistics" file, and report what it says for 
"Format:".

I assume you didn't specify a "-F" flag, so the output file was in 
libpcap format.