Wireshark-users: Re: [Wireshark-users] Capturing and merging files from different machines
Chris Swinney wrote:
I have taken a capture on two different machines from an in-line network
tap (one to capture upstream, one to capture downstream data). I now
need to merge these file, but when I ask Wireshark to merge them
chronologically, it seems to merge them based on the initial time taken
into the capture, not the actual capture time.
What do you mean by the "initial time taken into the capture" and "the
actual capture time"?
As a side note, is it possible to �shut up� the capturing machines from
trying to send network traffic on the capturing interfaces (Windows
XP/Vista), so in effect they just listen?
Turning name resolution off in Wireshark might help, but that only
limits what Wireshark does on the network, not what anything else
running on the machine does on the network. I don't know whether
network interfaces can be configured "down" on Windows, or whether
WinPcap will recognize interfaces configured "down" so that you can
capture on them.