Hi Erik On 2016-01-26 at 11:12:04 +0100, e.bengts...@gmail.com <e.bengts...@gmail.com> wrote: > Hi everyone! > > I've googled a bit but not found any good answer to my question. Maybe you > can help me out? > > Currently I'm running five netsniff processes capturing data from five > different interfaces. It works really well with the limiting factor SSD write > speed, not netsniff itself. To make post processing easier, it would be nice > if all log files were the same size and each set of files had the same start > time. > > It seems like netsniff only checks file size / time when a packet is received > so the start time within a set of files drift more or less depending on the > busload.
What do you mean by start time? The time of the first packet in the file? Or the file creation time? The timestamps of the packets stem directly from the kernel and are set at the time the packet arrives. But since these are all in the same timebase (kernel time) in all the files you should be able to align them, no? As for the size, yes this is true. The file size is only checked whenever a new packet arrives. > Any ideas on how to synchronize the processes? As outlined above, you should be able to synchronize after capturing based on the pcap timestamps. Or didn't I understand your problem right? Best Tobias -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.
