Wireshark · Ethereal-users: Re: [Ethereal-users] Problem with Elapsed Time reading Sniffer File

[Hansang Bae <hbae@xxxxxxxxxx>]

>David_Long@xxxxxxxxxxxx wrote:
>When Ethereal 0.10.9 (on WinXP-SP1) reads a file from Sniffer version 4.70.04 (on Win2K-SP4), it reports the elapsed time compressed by a factor of about 3.6, i.e. a capture of 1 minute and 23.1 seconds on the Sniffer appears only to be 23.2 seconds long in Ethereal. The compression is equal throughout the capture, i.e. you can take any elapsed time in Ethereal, multiply it by 3.6 and get the original elapsed time in Sniffer.


Interesting.  I have a file (will post after anonymizing it) that is off by a factor of about 3 as well.  It may even be 3.6, but I can't remember.  I'll post it sometime this week.

hsb