Wireshark · Ethereal-users: Re: [Ethereal-users] Timestamps "jump back" by ~13 seconds

[Sake Blok <sake@xxxxxxxxxx>]

On Fri, Apr 07, 2006 at 08:25:30AM -0400, Feeny, Michael (TD&DS,  Applications Infrastructure Svcs.) wrote:
> 
> If I understand how Winpcap works (that's a big "IF"), Winpcap grabs the
> packet, applies a timestamp using the system clock, passes it to
> Ethereal, who gives it the next frame number and adds it to the packet
> set, and waits for the next packet.  So, how these timestamps are
> showing this behavior has got me good and puzzled :-).

Does the clock of the PC show the same behaviour, I guess it does. 
Could it be that the PC is using time-synchronizing like NTP? I have
seen this kind of behaviour in a non-optimal NTP setup where the
NTP-client kept setting the clock forward and backwards in time.


Cheers,   Sake