This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

TCP time question_sending time is later than receiving time

0

I connected two computers in one local area network by using MQTT protocol. But in the first tcp three way handshake seems have some time problem. 10.1.1.5 is my client, 10.1.1.10 is my server. The first graph is the result in my client, the second graph is the result in my server. The first one of tcp three way handshake seems right, because the time when my server received is later than the time when my client send. But for the second and third of tcp three way handshake, the sending time is later than the receiving time. What's the problem.

Appreciated for all reply.

alt text

alt text

asked 30 Aug '16, 01:40

vviolett's gravatar image

vviolett
1114
accept rate: 0%


2 Answers:

1

The timestamps are generated by the capturing mechanism on each machine, so when performing captures on both the client and server, the timestamps will be those of the capturing machine and not related.

The first image (captured on the client) shows a round-trip time between the client's initial SYN and the server's SYN, ACK response of ~2.5 ms, with the client's SYN, ACK going out very quickly (60us) in reply.

The second image (captured on the server) shows the server's SYN, ACK response to the client's initial SYN is sent after ~116 us, and the client's SYN, ACK is received after ~2.5 ms, consistent with the rtt observed on the client capture.

In short, all looks normal to me.

answered 30 Aug '16, 03:12

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

0

Who says the timestamping clocks on both machines are exactly synhronized? This is a very difficult subject (distributed clocks), so unless there's IEEE 1588 synchronized Ethernet and hardware timestamping, it's virtually impossible to assume these clocks are in synch.

answered 30 Aug '16, 03:54

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%