First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

Displaying incorrect delta time for display filtered data

After updating to 4.0.2 I have noticed that the "Time since previous displayed frame" is sometimes incorrect. Usually by many seconds when the actual delta should be milliseconds or less. For example, consider two display adjacent frames. Frame 149752 has an epoch time of 1672928416.072060000 and frame 150424 has an epoch time of 1672928416.996811000. However, frame 150424 reports a time delta from previous displayed frame of 159.926315000 seconds. < I would provide example screenshots, but apparently I am not allowed.>

ejhellertc's avatar
3
ejhellertc
asked 2023-01-05 14:57:07 +0000
edit flag offensive 0 remove flag close merge delete

Comments

Screenshots would be less than helpful as we'll probably require access to other fields. Can you publicly share a capture with the packets of interest?

grahamb's avatar grahamb (2023-01-05 15:37:56 +0000) edit
more
  • delete

Unfortunately, I am not able to share the capture. It contains proprietary data, both ours and our suppliers. I also tried to export the selected frames, but when opened in a new session, the delta time displayed properly. I also tried to export the specified frames along with the intervening frames. Again, the delta time displayed properly when using the same display filter. This example was just one of many in my capture that displayed incorrect deltas. The values were both positive and negative. Oddly, in the process of trying to see what would happen with a smaller subset for export, I changed the display filter from looking at "data.data contains XXXX and tcp.port == YYY" to a specific range of frames. When I went back to look at the full dataset with my prior display filter, the delta time values seem to be displaying proper values. This was ... (more)

ejhellertc's avatar ejhellertc (2023-01-05 16:18:38 +0000) edit
more
  • delete
add a comment see more comments

1 Answer

0

Did you by any change sorted on any other column than the frame number? The "delta time displayed" is not aware of sorting and will show the delta between the packet and the previous packet in the capture file that matched the filter (so "displayed" is actually a bit misleading)

SYN-bit's avatar
18.5k
SYN-bit
answered 2023-01-06 09:55:53 +0000
edit flag offensive 0 remove flag delete link
more

Comments

A thought, however, I was sorting by frame. I did notice that the error seemed to be related to the number of frames captured. My capture had about 600,000 frames or more. When I applied the display filter during the live capture, the time delta was incorrect for some of the older entries, but was correct for the new entries. I also observed that exporting the displayed frames and then viewing the saved file, the entries were all correct.

ejhellertc's avatar ejhellertc (2023-01-06 13:39:14 +0000) edit
more
  • delete

Does a reload of the capture file (View -> Reload) after stopping the capture solve the issue too?

SYN-bit's avatar SYN-bit (2023-01-06 17:39:28 +0000) edit
more
  • delete
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer