Wireshark · Wireshark-dev: Re: [Wireshark-dev] How does tshark "synchronize" multiple interfaces?

[Guy Harris <guy@xxxxxxxxxxxx>]

On Feb 6, 2018, at 8:39 AM, S. Jacobi <sjacobi@xxxxxxxxxxxxxxxx> wrote:

> I wasn't able to spot this mechanism in the code,

That's because it's not in the code, which would certainly explain why you're getting packets out of order.

So dumpcap needs to sort packets by time stamp before writing them to the capture file if it's capturing from multiple interfaces.