Home page logo
/

wireshark logo Wireshark mailing list archives

If I start tcpdump instances on the same machine, the real time on both captured pcap files follow the same benchmark or not?
From: liu lily <politoesolve () gmail com>
Date: Wed, 26 Jun 2013 18:50:23 +0200

I run two tcpdump instances on the same linux machine, one is to capture
packets on eth0 and the other is for capturing packets on a virtual NIC.
And I get two pcap file.

basically, a packet first traverse eth0 and then the virtual NIC, and I
want to get the time difference between these two traversals.

 I use wireshark over these two pcap file to check the real time when the
packet is captured.
 I want to know whether the real time on both files are consistent with
each other or not? I mean are they following the same time benchmark?

thanks!
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
  • If I start tcpdump instances on the same machine, the real time on both captured pcap files follow the same benchmark or not? liu lily (Jun 26)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]