Chris Swinney wrote:
I may have miss read the merged file. I'm not sure if the merged file is totally correct as I seem to be getting responses before requests, but they DO appear to be in chronological order. I'm not sure at which point the time stamp is applied to the packet and if the sniffing PC's have any effect on this - I think not. I assume that the time stamp is applied to the header by whatever device sent the packet, not by a device listening.
The timestamps are put in by the capturing device (though where in the
stack this happens varies by OS)--so having the 2 systems NTP sync'd
would certainly help.
