First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Why Wireshark shows several SV packages with the same arrival time?

  • retag add tags

Why Wireshark shows several SV packages with the same arrival time using a Windows 11 laptop, with the USB - RJ45 interface

ncasilla's avatar
1
ncasilla
asked 2023-02-02 19:13:57 +0000
edit flag offensive 0 remove flag close merge delete

Comments

It is safe to say that we don't know.

My guess however would be that the USB driver gets them all at once from the adapter and that is the timestamp that is relevant for your machine.USB ethernet devices are not on my list of best tools for the job.but sometims you have to go with what you have.

hugo.vanderkooij's avatar hugo.vanderkooij (2023-02-03 06:51:41 +0000) edit
add a comment see more comments

1 Answer

0

The timestamps are generated by the capture library (npcap on windows, libpcap on other systems). The path a packet travels before it reaches the capture library can involve some buffers (I bet there are buffers on the USB-RJ45 interface itself, as well as some buffering in the driver for the USB-RJ45 interface). So when a burst of buffered packets pass the capture library, they can end up having the same timestamp.

Also, there are multiple timestamping options in WIndows, there is a trade-off between accuracy and precision. One mode is more accurate, but less precies (it uses 10/15 ms timeticks) and the other one is more precise (microsecond precision IIRC), but it can drift from the system clock a little bit over time. So if you use the "accurate" mode, all packets received in a 10/15 ms interval will get the same timestamp. See also: https://github.com/nmap/npcap/issues/583

SYN-bit's avatar
18.5k
SYN-bit
answered 2023-02-03 13:44:15 +0000
edit flag offensive 0 remove flag delete link

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer