How do I reorder packets by time stamp if they're out-of-order in the file?

asked 2023-05-04 14:07:45 +0000

Coronitabob
1 ●1 ●1

updated 2023-05-04 19:39:34 +0000

Guy Harris
19890 ●3 ●659 ●207

Hello everyone. I have a virtual machine with several network cards to receive traces from several VLANs. The problem is that sometimes the chronological order of packet reception does not match with the actual date. I use it to verify SIP calls and it is difficult to see the information if you don't have it sorted. A SIP call is shown in order of packet arrival and I don't see how to change it to the date of the packet. Does anyone have any idea. Surely there is a buffer before writing the packet with a time delay to be able to sort. There may be a difference between packets of 0.01sg approx. Thank you very much for your help.

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2023-05-04 19:44:46 +0000

Guy Harris
19890 ●3 ●659 ●207

Surely there is a buffer before writing the packet with a time delay to be able to sort.

It would be possible to have a program that captures packets buffer up a set of packets and write out batches of packets, sorting the packets in that batch by the time stamp delivered by the capture mechanism.

However, the libpcap library (used by tcpdump, Wireshark's capture program dumpcap, and some other programs) does not sort packets in a batch by time stamp before delivering them to programs that use it, and neither tcpdump nor dumpcap don't sort packets in a batch by time stamp by writing them. (The OS capture mechanisms that deliver packets to libpcap on various platforms don't sort packets, either.)

Therefore, Chris Maynard's suggestion that you use reordercap is probably the best way to handle this problem.

edit flag offensive delete link

Comments

Thank you very much for the quick response!!!! The reordercap command is working correctly. It was not the solution I was expecting but I understand your explanation. Thank you very much

Coronitabob ( 2023-05-05 07:17:49 +0000 )edit

Thank Chris first - he responded first and indicated what to do, I just noted that sorting by time sta ispmn't done in most capture paths, so you'd need to use reordercap.