[Winpcap-users] wireshark timing issue on server side

[Gianluca Varenni]

Forget my previous mail. You changed the timestamping mode to QuerySystemTime. The granularity is 10-15ms with QuerySystemTime, so that's why the two packets have the same timestamp.

Have a nice day
GV

-----Original Message-----
From: winpcap-users-bounces at winpcap.org [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of tfcrowe at eircom.net
Sent: Tuesday, December 21, 2010 8:11 AM
To: winpcap-users at winpcap.org
Subject: [Winpcap-users] wireshark timing issue on server side

Can anyone shed some light on why I'm getting these timestamps which don't seem to make sense ...

Scenario: Client and server windows boxes. Latest wireshark installed on each. Tried simple file upload using filezilla from client to server. Server is a hosted box (probably virtualized environment) but I have taken account of this fix http://www.winpcap.org/pipermail/winpcap-bugs/2010-January/001153.html. Client connection goes out over office lan so I'm assuming wired connection all the way to the server.

Issue: During the FTP setup protocol, the PORT request received on the server has the same timestamp as the previous ftp request ("TYPE A"). How could this be?