Ask Your Question

Displaying incorrect delta time for display filtered data

asked 2023-01-05 14:57:07 +0000

ejhellertc gravatar image

After updating to 4.0.2 I have noticed that the "Time since previous displayed frame" is sometimes incorrect. Usually by many seconds when the actual delta should be milliseconds or less. For example, consider two display adjacent frames. Frame 149752 has an epoch time of 1672928416.072060000 and frame 150424 has an epoch time of 1672928416.996811000. However, frame 150424 reports a time delta from previous displayed frame of 159.926315000 seconds. < I would provide example screenshots, but apparently I am not allowed.>

edit retag flag offensive close merge delete


Screenshots would be less than helpful as we'll probably require access to other fields. Can you publicly share a capture with the packets of interest?

grahamb gravatar imagegrahamb ( 2023-01-05 15:37:56 +0000 )edit

Unfortunately, I am not able to share the capture. It contains proprietary data, both ours and our suppliers. I also tried to export the selected frames, but when opened in a new session, the delta time displayed properly. I also tried to export the specified frames along with the intervening frames. Again, the delta time displayed properly when using the same display filter. This example was just one of many in my capture that displayed incorrect deltas. The values were both positive and negative. Oddly, in the process of trying to see what would happen with a smaller subset for export, I changed the display filter from looking at " contains XXXX and tcp.port == YYY" to a specific range of frames. When I went back to look at the full dataset with my prior display filter, the delta time values seem to be displaying proper values. This was ...(more)

ejhellertc gravatar imageejhellertc ( 2023-01-05 16:18:38 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted

answered 2023-01-06 09:55:53 +0000

SYN-bit gravatar image

Did you by any change sorted on any other column than the frame number? The "delta time displayed" is not aware of sorting and will show the delta between the packet and the previous packet in the capture file that matched the filter (so "displayed" is actually a bit misleading)

edit flag offensive delete link more


A thought, however, I was sorting by frame. I did notice that the error seemed to be related to the number of frames captured. My capture had about 600,000 frames or more. When I applied the display filter during the live capture, the time delta was incorrect for some of the older entries, but was correct for the new entries. I also observed that exporting the displayed frames and then viewing the saved file, the entries were all correct.

ejhellertc gravatar imageejhellertc ( 2023-01-06 13:39:14 +0000 )edit

Does a reload of the capture file (View -> Reload) after stopping the capture solve the issue too?

SYN-bit gravatar imageSYN-bit ( 2023-01-06 17:39:28 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2023-01-05 14:57:07 +0000

Seen: 285 times

Last updated: Jan 06 '23