On Fri, Nov 08, 2002 at 06:48:40PM -0500, Chris Rapier wrote: > > It would probably work better if the time stamps in the two capture > > files on each of the ports were synchronized. > > That may prove tricky depending on how much clock drift there is. CAIDA > and Waikato in NZ have done a lot of this sort of thing but they made > use of GPS syncs which I don't have access to (being that I can't > squeeze any more money out of the budget at this point).
Well, as long as the time stamps don't drift *so* much that you see replies before requests, it probably won't be too bad a problem. If they do, a number of dissectors won't be able to dissect as much as they could if the request came before the reply in the capture.
