Home page logo

wireshark logo Wireshark mailing list archives

Negative time difference between two following packets. frame.time_delta is negative
From: Jaroslav Kazejev <jaroslav.kazejev () ericsson com>
Date: Tue, 16 Apr 2013 06:41:55 +0000


I have a capture taken with an Ethernet tap/splitter/monitor where several packets have a negative time difference to 
the previous packet, i.e. frame.time_delta is below zero. Actually, 13.4 % of all packets in the file have this 
characteristic, which can easily be seen by applying the filter

frame.time_delta < 0

It is only packets that go in one direction, e.g. from server to client, that appear to get negative time delta and 
this leads me to think that whatever causes this is not only due to some fault or feature in Wireshark itself.

What can this be caused by?

Best Regards,
Jaroslav Kazejev
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]