Why does wireshark display the same timestamp for all frames?

asked 2021-04-09 13:40:12 +0000

nicu gravatar image

Hi,

I am running wireshark on an Intel NUC on which I inject a couple of frames. It seems that if the gap between them is less that 30us the inter-frame delta (in wireshark) is 0 for all of them (above 30us it is displayed correctly). Could this be hardware related or my wireshark settings are off?

Thank you

edit retag flag offensive close merge delete

Comments

Wireshark displays (and calculates) times using the values in the capture file. The times in the capture file are placed there by the capturing library which varies by OS.

The issue is almost certainly caused by limitations in the capture library. If you post a comment with the contents of the Help -> About Wireshark -> Wireshark dialog, we can see the required info about OS and capture library.

grahamb gravatar imagegrahamb ( 2021-04-09 13:48:38 +0000 )edit

Timestamps Wiki page and some details from a previous question: Frame Arrival Time drift
As @grahamb mentioned, having the OS info and Wireshark version will help to diagnose.

Chuckc gravatar imageChuckc ( 2021-04-09 13:54:21 +0000 )edit

Hi,

Thank you for the replies. Here is the capture from wireshark:

3.4.4 (v3.4.4-0-gc33f6306cbb2)

Compiled (64-bit) with Qt 5.15.1, with libpcap, with GLib 2.52.3, with zlib
1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with Lua 5.2.4, with GnuTLS 3.6.3
and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB
resolver, with nghttp2 1.39.2, with brotli, with LZ4, with Zstandard, with
Snappy, with libxml2 2.9.9, with QtMultimedia, with automatic updates using
WinSparkle 0.5.7, with AirPcap, with SpeexDSP (using bundled resampler), with
Minizip.

Running on 64-bit Windows 10 (1909), build 18363, with Intel(R) Core(TM)
i5-10210U CPU @ 1.60GHz (with SSE4.2), with 7996 MB of physical memory, with
locale English_Austria.utf8, with light display mode, without HiDPI, with Npcap
version 1 ...
(more)
nicu gravatar imagenicu ( 2021-04-09 14:37:18 +0000 )edit

So using npcap 1.10. There is an old closed issue on their tracker here discussing timestamping that might help.

Regardless, this is an npcap issue so should be raised with the nice folks over there.

grahamb gravatar imagegrahamb ( 2021-04-09 14:45:12 +0000 )edit
add a comment