Ask Your Question

Is it possible to start a capture's timer when the capture button is clicked?

asked 2019-07-31 08:00:37 +0000

..... and not when the first packet is seen?

I want to be able to time network events from the time a device is powered up (which is when I start the capture file). Currently I can only see timers starting when the first packet is captured.

edit retag flag offensive close merge delete


And what timer would this be? Are you referring to the timestamp of the first packet?

grahamb gravatar imagegrahamb ( 2019-07-31 09:21:06 +0000 )edit

Hi. No Id like the timer to start when I click the capture start button so I can time the delay from a device powering up to when it starts its network activity.

Waldo W gravatar imageWaldo W ( 2019-07-31 10:44:41 +0000 )edit

I think you'd need to start capturing on another machine and then generate a packet (ping, for example) while simultaneously powering up the Device Under Test (DUT). Your capture machine should capture the marker packet and that will allow you to have a time reference you can use for all other measurements.

A marker I like to use instead of an ICMP echo request (ping) is a syslog packet generated from nc (a.k.a., netcat). For example:

echo -n "Powering up device now" | nc -w 0 -u 514

[Conduct tests.]

echo -n "Test complete" | nc -w 0 -u 514
cmaynard gravatar imagecmaynard ( 2019-07-31 13:49:50 +0000 )edit

Hi - thanks for responding. I wont be able to ping the capture machine in this case as its connected to a SPAN destination port for the purpose of capturing. I like your suggestion of using marker packets and will certainly make use of them where possible. Thanks again

Waldo W gravatar imageWaldo W ( 2019-07-31 15:01:36 +0000 )edit

You should still be able to capture the marker though, right? You don't really care if the switch actually passes the packet or not, only that the capture device connected to the switch records the marker in the capture file, which it should.

cmaynard gravatar imagecmaynard ( 2019-07-31 15:14:29 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2019-07-31 13:33:54 +0000

grahamb gravatar image

I think you want the time of the first packet to display the offset from when the capture was started, rather than the current (when "Seconds Since Beginning of Capture" time format is selected) 0.000000.

Unfortunately, I don't think that's currently possible as the capture file format (pcap or pcapng) doesn't record the start time of the capture, only the timestamp of each packet.

It might be possible to add the capture start time to the capture, please raise an enhancement request on the Wireshark Bugzilla.

edit flag offensive delete link more


Thanks for the suggestions - Ill raise an enhancement request as you suggest - Cheers!

Waldo W gravatar imageWaldo W ( 2019-07-31 14:59:09 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2019-07-31 08:00:37 +0000

Seen: 25 times

Last updated: Jul 31