Revision history [back]

In my .pcap file captured in WLAN, I am getting current packet duration (given by wlan_radio.duration filter) more than the difference between the capture times of current and next packets, which I calculate by subtracting the values of frame.time_relative of the two packets. How come is it possible? If such a thing happened, it will mean that the first packet was still being captured when the next packet arrived. So, which one is correct: the duration field displayed by the Wireshark, or the packet capture times?

In my .pcap file captured in WLAN, I am getting current packet duration value (given by wlan_radio.duration filter) more than the difference between the capture times of current and next packets, which I calculate by subtracting the values of frame.time_relative of the two packets. How come is it possible? If such a thing happened, it will mean that the first packet was still being captured when the next packet arrived. So, which one is correct: the duration field displayed by the Wireshark, or the packet capture times?

In my .pcap file captured in WLAN, I am getting the duration of the current packet duration value (given by wlan_radio.duration filter) more than the difference between the capture times of current and next packets, which I calculate by subtracting the values of frame.time_relative of the two packets. packets.

How come is it possible? If such a thing happened, it will mean that the first packet was still being captured when the next packet arrived. For example, for two packets, capture times are T1=0.002124s, T2=0.003407s, so T2-T1=0.001283s, and the duration of the first packet (given in the wlan_radio.duration filed), D=0.002112s, which makes D>T2-T1. So, which one is correct: the duration field displayed by the Wireshark, or the packet capture times?

In my .pcap file captured in WLAN, I am getting the duration of the current packet more than the difference between capture times of current and next packets.

How come is it possible? If such a thing happened, it will mean that the first packet was still being captured when the next packet arrived. For example, for two packets, capture times are T1=0.002124s, T2=0.003407s, so T2-T1=0.001283s, and the duration of the first packet (given in by the wlan_radio.duration filed), display filter), D=0.002112s, which makes D>T2-T1. So, which one is correct: the duration field displayed by the Wireshark, or the packet capture times?