Wireshark-users: Re: [Wireshark-users] Capturing and merging files from different machines
From: Guy Harris <[email protected]>
Date: Wed, 18 Jun 2008 09:10:52 -0700
Chris Swinney wrote:

I have taken a capture on two different machines from an in-line network tap (one to capture upstream, one to capture downstream data). I now need to merge these file, but when I ask Wireshark to merge them chronologically, it seems to merge them based on the initial time taken into the capture, not the actual capture time.
What do you mean by the "initial time taken into the capture" and "the 
actual capture time"?
As a side note, is it possible to “shut up” the capturing machines from trying to send network traffic on the capturing interfaces (Windows XP/Vista), so in effect they just listen?
Turning name resolution off in Wireshark might help, but that only 
limits what Wireshark does on the network, not what anything else 
running on the machine does on the network.  I don't know whether 
network interfaces can be configured "down" on Windows, or whether 
WinPcap will recognize interfaces configured "down" so that you can 
capture on them.