Revision history [back]

On my packet capture on Wireshark I have a column called "time delta from previous captured frame" as well as "time delta from previous displayed frame".

1- What is the difference between these two?

If you don't have a display filter limiting which packets appear in the packet list, there is no difference.

If you do have a display filter limiting which packets appear in the packet list then:

• the "time delta from previous captured frame" is the difference in time stamps between the packet in question and the packet before it in the capture, even if that packet isn't currently being displayed because it didn't match the display filter;
• the "time delta from previous displayed frame" is the difference in time stamps between the packet in question and the packet before it in the packet list.

2- Is one of them the same as packet inter arrival time?

That depends on how the packet interarrival time is defined and how the capture was done.

If:

• the packet interarrival time for a given network interface is defined as the time difference between packets that arrive on that interface;
• the capture was done without any capture filter, and no packets were dropped by the adapter or by any part of the packet capture mechanism, so that every single packet that arrived on the interface is in the capture;

then the "time delta from previous captured frame" would be an approximation of the packet interarrival time for the packet and the previous packet.

I say "approximation" because, in most cases, the time stamps come from the operating system, which means that they aren't necessarily the exact arrival time of the packet on the network interface - there may be various delays due to interrupt latency, packet batching (so that multiple packets are picked up in response to a single interrupt), time delays between the point in time at which the host is told that the packets have arrived and the time at which it time-stamps the packet, etc..