I can find "Time since first frame in this TCP stream:" and "Time since previous frame in this TCP stream:" fields in the Timestamps of TCP. My question is are these two values same as the "Arrival time" of the Frame header?
Who sets these values? The sender or the OS at the receiver's side?
Note that these fields are added in square brackets. That is the format of fields which are not contained in the packet itself, but derived by Wireshark based on the current and other, related, frames.
I.e., they are calculated from values set by the hardware or software on the machine on which the traffic is captured; that might be the sending machine, the receiving machine, or some other machine doing network sniffing.
"Time since first frame in this TCP stream" is the difference between the "Arrival time" of the frame in question and the "Arrival time" of the first frame in the TCP stream; "Time since previous frame in this TCP stream" is the difference between the "Arrival time" of the frame in question and the "Arrival time" of the previous frame in the TCP stream.
Asked: 2018-08-24 20:04:41 +0000
Seen: 2,821 times
Last updated: Aug 25 '18
