It says in the link you sent that precision is 10-15 ms. Sound to me like if the 2nd packet comes in less than 15ms it could be tagged with the same time.
Michael D. Black Senior Scientist NG Information Systems Advanced Analytics Directorate ________________________________________ From: [email protected] [[email protected]] on behalf of [email protected] [[email protected]] Sent: Tuesday, December 21, 2010 10:11 AM To: [email protected] Subject: EXT :[Winpcap-users] wireshark timing issue on server side Can anyone shed some light on why I'm getting these timestamps which don't seem to make sense ... Scenario: Client and server windows boxes. Latest wireshark installed on each. Tried simple file upload using filezilla from client to server. Server is a hosted box (probably virtualized environment) but I have taken account of this fix http://www.winpcap.org/pipermail/winpcap-bugs/2010-January/001153.html. Client connection goes out over office lan so I'm assuming wired connection all the way to the server. Issue: During the FTP setup protocol, the PORT request received on the server has the same timestamp as the previous ftp request ("TYPE A"). How could this be? _______________________________________________ Winpcap-users mailing list [email protected] https://www.winpcap.org/mailman/listinfo/winpcap-users
