Time deltas from previous frames are zeros
Hi Wireshark community,
I am using the Wireshark to observe 1 Gbit Ethernet traffic at the Ethernet Port of the Intel NUC (Model NUC10i5FNHCA). The traffic frames are displayed correctly and also in the correct order but the time values are faulty. Namely, the time deltas between the frames display only zeros - as all frames are received at the same time.
When using the Wireshark on my main computer (with the same Network Card as the Intel NUC) I am able to observe the traffic and the time differences around 5-10 microseconds.
I have already updated drivers, BIOS, turned off all power-saving features and increased the performance of the network adapter .. I would be very thankful if anyone could support me on this problem and explain me why I cant see those time values on the Intel NUC..
Copy of Wireshark Info:
3.4.4 (v3.4.4-0-gc33f6306cbb2)
Compiled (64-bit) with Qt 5.15.1, with libpcap, with GLib 2.52.3, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.39.2, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.9.9, with QtMultimedia, with automatic updates using WinSparkle 0.5.7, with AirPcap, with SpeexDSP (using bundled resampler), with Minizip.
Running on 64-bit Windows 10 (1909), build 18363, with Intel(R) Core(TM) i5-10210U CPU @ 1.60GHz (with SSE4.2), with 7996 MB of physical memory, with locale English_Austria.utf8, with light display mode, without HiDPI, with Npcap version 1.10, based on libpcap version 1.9.1, with GnuTLS 3.6.3, with Gcrypt 1.8.3, with brotli 1.0.2, without AirPcap, binary plugins supported (21 loaded).
npcap is a couple versions behind. There have been some changes related to timestamps that might help.
Thank you for your answer! I have updated the Npcap to 1.30 and still no changes ...
Can you share a capture file from the NUC?
The Wireshark capinfos command will display timestamp precision from the capture files:
C:\>capinfos host_hi_ts.pcapng | findstr /I precis File timestamp precision: microseconds (6) Time precision = microseconds (6)Thank you for your answer!
The data from the capture file: File timestamp precision: microseconds (6) Time precision: microseconds (6)
I still did not figure out what could be the issue..
The issue is the granularity of the timestamping mechanism used by the capture library, in this case npcap, and the granularity of how those timestamps are stored, in this case the pcap format.
An old npcap issue, #46 discusses timestamp options, I have no idea if those are still supported,
As this is an npcap issue, discussions are best taken over to the npcap support system.