Wireshark-users: [Wireshark-users] If I start tcpdump instances on the same machine, the real tim

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: liu lily <politoesolve@xxxxxxxxx>
Date: Wed, 26 Jun 2013 18:50:23 +0200
I run two tcpdump instances on the same linux machine, one is to capture packets on eth0 and the other is for capturing packets on a virtual NIC. And I get two pcap file.

basically, a packet first traverse eth0 and then the virtual NIC, and I want to get the time difference between these two traversals.

 I use wireshark over these two pcap file to check the real time when the packet is captured.
 I want to know whether the real time on both files are consistent with each other or not? I mean are they following the same time benchmark?

thanks!