<HTML xmlns:eXclaimer="http://www.exclaimer.co.uk">
<HEAD>
<META http-equiv="Content-Type" content="text/html; charset=UTF-16">
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-16">
<meta http-equiv=Content-Type content="text/html; charset=us-ascii">
<meta name=Generator content="Microsoft Word 11 (filtered medium)">
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="City"/>
<o:SmartTagType namespaceuri="urn:schemas-microsoft-com:office:smarttags"
name="place"/>
<!--[if !mso]>
<style>
st1\:*{behavior:url(#default#ieooui) }
</style>
<![endif]-->
<style>
<!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Comic Sans MS";
panose-1:3 15 7 2 3 3 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman";}
a:link, span.MsoHyperlink
{color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{color:purple;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
p
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman";}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:Arial;
color:windowtext;}
@page Section1
{size:8.5in 11.0in;
margin:1.0in 1.25in 1.0in 1.25in;}
div.Section1
{page:Section1;}
-->
</style>
</HEAD>
<BODY lang=EN-US link=blue vlink=purple>
<DIV>
<div class=Section1>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Hi all…<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I used Ethereal (very recent version) to capture packets
yesterday. When I open the resultant Ethereal file, I notice that about
every 5 or 10 packets, the timestamp is roughly 13 seconds earlier than that of
the previous packet. <o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Looking more closely, I see a clump of packets with timestamps
that increase normally, then a clump that are 13 seconds earlier (but whose
timestamps also increase normally), then a clump that are 13 seconds later (lining
up with the 1<sup>st</sup> clump), then a 13-seconds-earlier clump, etc., etc.,
etc.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I’m probably not explaining this well </span></font><font
size=2 face=Wingdings><span style='font-size:10.0pt;font-family:Wingdings'>L</span></font><font
size=2 face=Arial><span style='font-size:10.0pt;font-family:Arial'>. Here
is a sample of the timestamps – this should make it clearer…<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:35.475498<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:35.475604<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:35.475632<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:49.087976 (Jumps
ahead ~13.5 seconds)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:49.132457<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:49.132573<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:49.132604<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:49.134084<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:35.525248 (Jumps
back ~13.5 seconds)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:35.525376<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:35.525567<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:49.283965 (Jumps
ahead ~13.5 seconds)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:49.882512<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:49.882613<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>14:26:49.882645<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>… this pattern continues forever and ever (or, at
least for the 35 minutes of the capture)<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Has anyone seen this? Any ideas?<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>If I understand how Winpcap works (that’s a big “IF”),
Winpcap grabs the packet, applies a timestamp using the system clock, passes it
to Ethereal, who gives it the next frame number and adds it to the packet set,
and waits for the next packet. So, how these timestamps are showing this
behavior has got me good and puzzled </span></font><font size=2 face=Wingdings><span
style='font-size:10.0pt;font-family:Wingdings'>J</span></font><font size=2
face=Arial><span style='font-size:10.0pt;font-family:Arial'>.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>I’m waiting for Ethereal & Winpcap version info (I
don’t have direct access to the collecting system), as well as NIC info,
in case it’s relevant. But I thought I’d post this now, in
case there’s an obvious answer.<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Thx much,<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'>Michael<o:p></o:p></span></font></p>
<p class=MsoNormal><font size=2 face=Arial><span style='font-size:10.0pt;
font-family:Arial'><o:p> </o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=3 color=maroon
face="Comic Sans MS"><span style='font-size:12.0pt;font-family:"Comic Sans MS";
color:maroon'>Michael Feeny<o:p></o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=3 color=maroon
face="Comic Sans MS"><span style='font-size:12.0pt;font-family:"Comic Sans MS";
color:maroon'>TDDS Application Integration Management<o:p></o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=3 color=maroon
face="Comic Sans MS"><span style='font-size:12.0pt;font-family:"Comic Sans MS";
color:maroon'>609-274-2761 (Office)<o:p></o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=3 color=maroon
face="Comic Sans MS"><span style='font-size:12.0pt;font-family:"Comic Sans MS";
color:maroon'>484-995-1745 (</span></font><font face="Comic Sans MS"><span
style='font-family:"Comic Sans MS"'><ns1:City w:insAuthor="mfeeny1"
w:insDate="2006-04-06T11:36:00Z" w:endInsAuthor="mfeeny1"
w:endInsDate="2006-04-06T11:36:00Z"><ns1:place w:insAuthor="mfeeny1"
w:insDate="2006-04-06T11:36:00Z" w:endInsAuthor="mfeeny1"
w:endInsDate="2006-04-06T11:36:00Z"><st1:City w:st="on"><st1:place w:st="on"><font
color=maroon><span style='color:maroon'>Mobile</span></font></st1:place></st1:City></ns1:place></ns1:City><font
color=maroon><span style='color:maroon'>)<o:p></o:p></span></font></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=3 color=maroon
face="Comic Sans MS"><span style='font-size:12.0pt;font-family:"Comic Sans MS";
color:maroon'>1-888-MERRIL0 (Page)<o:p></o:p></span></font></p>
<p style='margin:0in;margin-bottom:.0001pt'><font size=3 color=maroon
face="Comic Sans MS"><span style='font-size:12.0pt;font-family:"Comic Sans MS";
color:maroon'>feenyman99 (AIM)</span></font><o:p></o:p></p>
<p class=MsoNormal><font size=3 face="Times New Roman"><span style='font-size:
12.0pt'><o:p> </o:p></span></font></p>
</div>
</DIV>
<DIV>
<HR COLOR="gray">
</DIV>
<DIV>If you are not an intended recipient of this e-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute it. <A HREF="http://www.ml.com/email_terms/">Click here </A>for important additional terms relating to this e-mail. <A HREF="http://www.ml.com/email_terms/">http://www.ml.com/email_terms/</A></DIV>
<DIV>
<HR COLOR="gray">
</DIV></BODY></HTML>