[prev in list] [next in list] [prev in thread] [next in thread]
List: wireshark-users
Subject: [Wireshark-users] Timing questions
From: "Bond, Peter" <PBond () tandbergtv ! com>
Date: 2009-02-27 16:17:20
Message-ID: EED026015238BA4D8383E6F2C17B9DA901B3144D () ttvuk_exch1 ! TANDBERGTV ! COM
[Download RAW message or body]
--===============5415710574550658235==
Content-class: urn:content-classes:message
Content-Type: multipart/alternative;
boundary="----_=_NextPart_001_01C998F6.DD7B4F27"
This is a multi-part message in MIME format.
Hi all -
We're seeing some slightly strange behaviours out of Wireshark in
certain situations; the system in question has both a Realtek network
card & a DekTec card.
1. Capturing under Windows on either card, there are negative
(absolute, not relative) timestamps crop up periodically throughout the
trace. Reading around, there seemed to be an incompatibility between an
older version of WinPcap and a newer version of Wireshark; this does not
appear to be the problem here (bundled install). Running a Linux
version (from a LiveCD), the problem disappears with the Realtek card; I
have not yet built a LiveCD with the DekTec drivers to be able to test
that case. I've seen some suggestions that the packet forwarding to the
WinPcap driver under Windows are a little indeterminate, is this the
likely culprit?
2. The packets being transmitted have a defined period between them
(about 1ms), yet at the start of every capture, the delta is in the
order of 1us instead. My best guess is that the Realtek card buffer is
being flushed to the pcap driver initially...? Since the interface is
in promiscuous mode before the capture starts, I'm not sure that the
assumption is valid.
My suspicion is that for absolute timing tests of this nature, we really
ought to be using a lower-level network analyser to keep the vagaries of
the OS out of the way.
All comments gratefully received.
Peter Bond
**********************************************************************
This communication is confidential and intended solely for the
addressee(s). Any unauthorized review, use, disclosure or distribution
is prohibited. If you believe this message has been sent to you in
error, please notify the sender by replying to this transmission and
delete the message without disclosing it. Thank you.
E-mail including attachments is susceptible to data corruption,
interception, unauthorized amendment, tampering and viruses, and we
only send and receive e-mails on the basis that we are not liable for
any such corruption, interception, amendment, tampering or viruses or
any consequences thereof.
This email, its content and any attachments is PRIVATE AND
CONFIDENTIAL to TANDBERG Television, Part of the Ericsson Group.
www.tandbergtv.com
**********************************************************************
[Attachment #3 (text/html)]
<html xmlns:o="urn:schemas-microsoft-com:office:office" \
xmlns:w="urn:schemas-microsoft-com:office:word" \
xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<style>
<!--
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:595.3pt 841.9pt;
margin:72.0pt 90.0pt 72.0pt 90.0pt;}
div.Section1
{page:Section1;}
/* List Definitions */
@list l0
{mso-list-id:1710569617;
mso-list-type:hybrid;
mso-list-template-ids:-2119815318 134807567 134807577 134807579 134807567 134807577 \
134807579 134807567 134807577 134807579;} @list l0:level1
{mso-level-tab-stop:36.0pt;
mso-level-number-position:left;
text-indent:-18.0pt;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
-->
</style>
</head>
<body lang=EN-GB link=blue vlink=purple>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Hi all –<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>We’re seeing some slightly strange behaviours out of
Wireshark in certain situations; the system in question has both a Realtek
network card & a DekTec card.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<ol style='margin-top:0cm' start=1 type=1>
<li class=MsoNormal style='mso-list:l0 level1 lfo1'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>Capturing under Windows on either
card, there are negative (absolute, not relative) timestamps crop up \
periodically throughout the trace. Reading around, there seemed to be an
incompatibility between an older version of WinPcap and a newer version of
Wireshark; this does not appear to be the problem here (bundled install).
Running a Linux version (from a LiveCD), the problem disappears with the
Realtek card; I have not yet built a LiveCD with the DekTec drivers to be
able to test that case. I’ve seen some suggestions that the
packet forwarding to the WinPcap driver under Windows are a little
indeterminate, is this the likely culprit?<o:p></o:p></span></font></li>
</ol>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<ol style='margin-top:0cm' start=2 type=1>
<li class=MsoNormal style='mso-list:l0 level1 lfo1'><font size=2 face=Arial><span
style='font-size:10.0pt;font-family:Arial'>The packets being transmitted
have a defined period between them (about 1ms), yet at the start of every
capture, the delta is in the order of 1us instead. My best guess is
that the Realtek card buffer is being flushed to the pcap driver \
initially…?
Since the interface is in promiscuous mode before the capture starts, I’m
not sure that the assumption is valid.<o:p></o:p></span></font></li>
</ol>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>My suspicion is that for absolute timing tests of this
nature, we really ought to be using a lower-level network analyser to keep the
vagaries of the OS out of the way. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>All comments gratefully received.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Peter Bond<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
</div>
<pre>**********************************************************************
This communication is confidential and intended solely for the
addressee(s). Any unauthorized review, use, disclosure or distribution
is prohibited. If you believe this message has been sent to you in
error, please notify the sender by replying to this transmission and
delete the message without disclosing it. Thank you.
E-mail including attachments is susceptible to data corruption,
interception, unauthorized amendment, tampering and viruses, and we
only send and receive e-mails on the basis that we are not liable for
any such corruption, interception, amendment, tampering or viruses or
any consequences thereof.
This email, its content and any attachments is PRIVATE AND
CONFIDENTIAL to TANDBERG Television, Part of the Ericsson Group.
www.tandbergtv.com
**********************************************************************
</pre></body>
</html>
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@wireshark.org?subject=unsubscribe
--===============5415710574550658235==--
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic