Wireshark · Ethereal-users: Re: [Ethereal-users] negative time

Ethereal-users: Re: [Ethereal-users] negative time

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Martin Regner" <martin.regner@xxxxxxxxx>

Date: Wed, 11 Dec 2002 22:14:05 +0100

Z.Qili wrote:

>HI,
>Does anybody know why there are so many negative time values in Ethereal?
>It seems impossible for "negative time" because the time is calculated
>comparing to the first packet sniffed.
>Zhou


What OS and libpcap/winpcap version are you using?

There seems to be a problem with WinPcap version 2.3 resulting in incorrect timestamps sometimes.

http://www.mail-archive.com/winpcap-users@xxxxxxxxxxxxxxxxx/msg00091.html
http://www.mail-archive.com/winpcap-users@xxxxxxxxxxxxxxxxx/msg00144.html

http://www.ethereal.com/lists/ethereal-users/200205/msg00087.html

Follow-Ups:
- Re: [Ethereal-users] negative time
  - From: Guy Harris

Prev by Date: [Ethereal-users] Does any one know, what percentage does of drop packet those Ethereal have? and what show you that i
Next by Date: Re: [Ethereal-users] negative time
Previous by thread: Re: [Ethereal-users] negative time
Next by thread: Re: [Ethereal-users] negative time
Index(es):
- Date
- Thread