Ask Your Question
0

When does the wireless timeline shows up?

asked 2020-06-16 16:43:14 +0000

Christian_R gravatar image

updated 2020-06-16 21:48:18 +0000

grahamb gravatar image

Hello, today I have seen this graph (see below) the first time?

  • What does it show me? My guess is, the gap between the frames.
  • How is the graph or pane called?
  • Why does it appear not in every tracefile I open? (I use the same profile)

new graph

Wireshark Version:

Version 3.0.11 (v3.0.11-0-ge314fe7ca6aa) 

Copyright 1998-2020 Gerald Combs <[email protected]> and contributors. License GPLv2+: GNU GPL version 2 or later <http://www.gnu.org/licenses/old-licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 

Compiled (64-bit) with Qt 5.12.8, with WinPcap SDK (WpdPack) 4.1.2, with GLib 2.52.2, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.14.0, with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.39.2, with LZ4, with Snappy, with libxml2 2.9.9, with QtMultimedia, with AirPcap, with SBC, with SpanDSP, with bcg729. 

Running on 64-bit Windows 10 (1803), build 17134, with Intel(R) Core(TM) i5-6300U CPU @ 2.40GHz (with SSE4.2), with 8071 MB of physical memory, with locale German_Germany.1252, with WinPcap version 4.1.3 (packet.dll version 4.1.0.2980), based on libpcap version 1.0 branch 1_0_rel0b (20091008), with GnuTLS 3.6.3, with Gcrypt 1.8.3, without AirPcap, binary plugins supported (19 loaded). Built using Microsoft Visual Studio 2017 (VC++ 14.16, build 27040). 

Wireshark is Open Source Software released under the GNU General Public License. 
Check the man page and https://www.wireshark.org for more information.
edit retag flag offensive close merge delete

Comments

Rephrased the question. So that the question might be better understandable for other people.

Christian_R gravatar imageChristian_R ( 2020-06-16 20:27:28 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
1

answered 2020-06-16 20:04:39 +0000

Chuckc gravatar image

updated 2020-06-16 20:16:00 +0000

"That looks like the wireless timeline." (Thx to Gerald for identifying)
There is an open Bugzilla tracking issues with it.
It seems to be very picky about the capture contents. Flashes the status bar yellow but message not visible.

This sample capture mesh.cap from the Wireshark Wiki has the TSFT flag set.

Time Synchronization Function Timer
.... .... .... .... .... .... .... ...1 = TSFT: Present
radiotap.present.tsft

Look for wlan_radio.timestamp if no radiotap header.

Preference setting required: wlan_radio.timeline = TRUE

If timeline enabled but not displayed, could be one of the conditions below:

"Packet number %u does not include TSF timestamp, not showing timeline."
"Packet number %u has large negative jump in TSF, not showing timeline. Perhaps TSF reference point is set wrong?"
edit flag offensive delete link more

Comments

Thx for the helpful answer. I personally like this graph, because it adds some useful information to the trace.and the tracefile navigation is also improved.

Maybe it might be worth to think about, if such kind of bar is also useful for ethernet traces.

Christian_R gravatar imageChristian_R ( 2020-06-16 20:36:22 +0000 )edit

Here I found also a good explanation of this timeline:

https://meraki.cisco.com/lib/pdf/mera...

Christian_R gravatar imageChristian_R ( 2020-06-16 20:41:49 +0000 )edit

Thanks! Maybe the User's Guide can point to the PDF when this feature is documented.

Chuckc gravatar imageChuckc ( 2020-06-17 02:38:59 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-06-16 16:43:14 +0000

Seen: 771 times

Last updated: Jun 16 '20