negative values in time
What is meant by the negative values on the Time
Additional records
<Root>: type OPT
[Request In: 7]
[Time: -0.058367000 seconds]
Switch the Time Display Format to Time of Day and visually confirm that the packets are in chronological order.
This can also be confirmed by running Wireshark's cli utility capinfos and checking the value of the Strict time order: field.
True indicates packets timestamps are in chronological order, False indicates that they are not.
When packets are not written to the capture in strict chronological order, Wireshark's various elapsed time analysis can result in physics defying duration reported between a query and its subsequent reply.
There are various reasons why capturing mechanisms produce captures where Strict time order of False. In some cases the actual order of the packets in the file is correct but the timestamps are just wrong. In other cases the timestamps of the packet are correct but order within the file is wrong. In the former case the editcap utility can be used to rewrite the timestamps of individual packets to ultimately satisfy the 'Strict time order' test. In the latter case the reordercap utility can be used to change to sort the packets by the original timestamps to also satisfy the 'Strict time order' test.
Asked: 2024-06-28 08:42:51 +0000
Seen: 277 times
Last updated: Jun 28
Are you looking at packets that match
dns.resp.type == 41 and dns.time < 0?<Root>: type OPT Name: <Root> Type: OPT (41) UDP payload size: 4096 Higher bits in extended RCODE: 0x00 EDNS0 version: 0 Z: 0x0000 Data length: 0 [Request In: 2086] [Time: 0.003947000 seconds]No, actually i am checking the dns query response time between our firewall and the DNS server. There i am seeing this -ve values.
(more)Sorting by packet number - could this be a capture issue?
(more)Can you include the request packet?
What is
View -> Time Display Formatset to?Where is the capture being made?