Guy,
The orginal example was sniffed using Optimal Application Expert. [A
strange choice I know but the Network General Sniffer that uised to sit on
my desk has been hijacked :-) ].
> From: Guy Harris [SMTP:guy@xxxxxxxxxx]
> Can you send us the capture file as produced by the program that did the
> capture?
I took a three traces simultaneously of my PC pinging another box. One using
NetMon. One using Optimal Application Expert, and one remotely using a 3Com
Superstack RMON2 Probe. This was done at around 1:01am BST as NetMon's Cap
file reports.
Here's what Tethereal thinks the time was :
D:\temp>tethereal -r 3com.trc -ta -V -n | find "Arrival Time"
Arrival Time: Jul 18, 2000 00:00:15.9859
<Snip>
D:\temp>tethereal -r netmon.cap -ta -V -n | find "Arrival Time"
Arrival Time: Jul 18, 2000 01:01:39.8760
<Snip>
D:\temp>tethereal -r OAE.trc -ta -V -n | find "Arrival Time"
Arrival Time: Jul 18, 2000 00:00:08.5723
<Snip>
Attached is a PNG file of what NetMon thinks the time was, plus the three
traces.
<<netmon.cap>> <<NetMonSays.png>> <<OAE.trc>> <<3com.trc>>
>From this I think I can deduce that:
1) Netmon in this trace (and in the previous Web page retreivial example,
oops!) , reports the time in GMT, even though its BST (=+1hr) in the UK at
the moment.
2) Netmon reports the correct time (-1 hour), but Tethereal cannot correctly
determine the time for either of the trc files.
BTW NetMon can read TRC files, it just can't write them.
Hope that helps,
Alistair
> --------------------------------------------------------------------
> Alistair McGlinchy, alistair.mcglinchy@xxxxxxxxxxxxxxxxxxxxx
> Sizing and Performance, Central IT ext. 5012, ph +44 0 20-7268-5012
> Marks and Spencer (Stockley Park) fx +44 0 20-7268-5721
> 1SW, 3 Longwalk Rd, Stockley Park, Uxbridge UB11 1AW, United Kingdom
>
__________________________________________________________________________________________
Registered Office:
Marks and Spencer plc
Michael House, Baker Street,
London, W1A 1DN
Registered No. 214436 in England and Wales.
Telephone (020) 7935 4422
Facsimile (020) 7487 2670
www.marks-and-spencer.com
This e-mail is Confidential. If you received it by mistake, please let us know and then
delete it from your system; you should not copy, disclose, or distribute its contents to
anyone nor act in reliance on this e-mail, as this is prohibited and may be unlawful.
___________________________________________________________________________________________Attachment:
netmon.cap
Description: Binary data
Attachment:
NetMonSays.png
Description: Binary data
Attachment:
OAE.trc
Description: Binary data
Attachment:
3com.trc
Description: Binary data