Wireshark mailing list archives

Help comparing two captures


From: "Keith French" <keithfrench () btconnect com>
Date: Wed, 19 May 2010 16:17:34 +0100

I have two captures one from the client end & one from the server end and I am trying to use the "Compare" facility 
from the Statistics menu. When I took the traces, I synchronised both laptops to an NTP server and both were running 
Wireshark V1.2.8.

I have merged them chronologically in Mergcap (no -a) and used a simple filter to break this down to one SIP call. The 
filter I used was:-

ip.addr eq 10.7.0.1 and (sip or rtp)

When I used the compare option (only specifying the same filter, leaving the other options as default) the info column 
gives me values of:-

0.000000001
0.000000003
0.000000005 etc.

Is this telling me that the first frame arrived at the server end 0.000000001 seconds after it left the client end?

Some frames now get coloured with the color filter:-

___tmp_color_filter___01

What is the significance of these frames?

I can email the merged trace if anyone can help me.

Keith French
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe

Current thread: