On Thu, Jun 27, 2002 at 02:37:34PM -0400, Greg Cox wrote:
> With Ethereal on Windows 2000 server, I get horrendously bad frame arrival
> times in my captures. In fact, despite the fact that the system clock (for
> the OS and BIOS) shows the correct time, Ethereal reports a seemingly random
> time
Ethereal reports the time it got from WinPcap, so this is almost
certainly a WinPcap problem, not an Ethereal problem.
You should try WinDump (with WinPcap 2.3), and, if the problem occurs
with WinDump as well, report it to the WinPcap developers - see
http://winpcap.polito.it/contact.htm
for details on reporting WinPcap bugs.
> Ethereal has worked quite well for me on Windows 2000 Workstation, RH Linux
> 7.2, Win98SE. For some reason, I've only had this issue with Windows 2000
> Server.
Report that to the WinPcap developers as well. (Well, the RH Linux part
is irrelevant to them, as that just means "the Linux networking code
correctly time-stamp packets"; the fact that WinPcap gives the right
time stamps on other Windows platforms is probably useful information,
however.)
(This presumably isn't an MP server machine, as WinPcap 2.3 refuses to
run on MP machines; the WinPcap developers have no MP machines on which
to test an MP-safe version of WinPcap.)