On Mon, Dec 29, 2008 at 04:27:44PM +0100, j.snelders@xxxxxxxxxx wrote:
> On Mon, 29 Dec 2008 11:00:37 +0100 Alexandre Aeschbach wrote:
>
> >The thing with the packet numbers you mentioned is a problem too. The
> >traces are not merged or edited.
> >
> >If I do the filtering with tshark I get no results for "scsi.time < -0.001".
>
> May be you have to use the '.' as the decimal symbol in stead of the ','
> Please take a look at Control Panel -> "Regional Settings and Language Options"
Well, tshark processes all packets in only one run, so if the command
comes before the response (as Wireshark makes you believe), then it can
not know the (negative) response time yet as it has not seen the request
yet when processing the response. Hence the difference between the
Wireshark and the tshark output...
Now... the main problem is why wireshark thinks these requests and
responses belong together, although they bend the nature of time ;-)
It would help to see the actual capture file instead of just a
screenshot.
HTH,
Cheers,
Sake
