> Kenn Humborg wrote:
> > I've got network packet captures from both ends of
> > a TCP connection and I'm try to figure out what's
> > happening during some intermittent packet-loss
> > episodes.
> > Currently, I'm looking at both traces in two Wireshark
> > windows, but it's less than ideal.
> > Does anyone know of a tool that would load up both
> > captures, synch them up (without having tight clock
> > sync at both ends) and tell me things like
> > o This packet took N ms to get to the other side
> > o This packet was received N times
> > o This packet was received out of order
> > o This packet was lost
>> Doesn't wireshark have a merge pcap file option in the GUI?
> It used to come with a mergecap util also I think.
> Also I remember using a tcpslice util, but that's
> years ago now.
There's a new option Statistics->Compare that seems to do
what I want. I'll still have to use editcap to time-adjust
one file , but it's better than nothing.
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!