Wireshark时间戳不准，比真实时间慢的解决方案

用Wireshark抓去网络包，结果发现时间戳的时间与真实时间有误差。抓包时间越长误差越大。

原来Wireshark是用的时间戳不是使用的真正的系统时间。它只是在抓包开始时使用系统时间，而之后时间的计算则是通过计算逝去累积时间加上开始时间而来。

这里给出一个使Wireshark时间戳与系统时间相同的解决方案。

不过虽然时间与系统时间相同了，但是精度也降低了。

It's a WinPcap specific setting.

HKLM\System\CurrentControlSet\Services\NPF\TimestampMode

Possible values are
0 (default) -> Timestamps generated through KeQueryPerformanceCounter, less 
reliable on SMP/HyperThreading machines, precision = some microseconds
2 -> Timestamps generated through KeQuerySystemTime, more reliable on 
SMP/HyperThreading machines, precision = scheduling quantum (10/15 ms)
3 -> Timestamps generated through the i386 instruction RDTSC, less reliable 
on SMP/HyperThreading/SpeedStep machines, precision = some microseconds

After you change the setting (you want use 2), you need to restart the NPF 
driver by opening an elevated command prompt and running "net stop npf" 
followed by "net start npf". (If in Win7, please make sure run the command prompt window as Administrator.)

Reference: Wireshark time behind the actual time
http://seclists.org/wireshark/2010/Aug/311

网友评论 加入收藏 打印本文 关闭此页

上一篇：Eclipse不能识别Android手机如何解决

下一篇：怎样设置Linux系统的主机名

昵称 (必填)

验证码 (必填)