Time display and deltas
The clock in the list is a view. Deltas measure the gap you asked for, which changes when a filter is on.
Pick a clock on purpose
View, then Time Display Format, changes the time column. Seconds since the beginning of the capture is the right default while you are matching events inside one file. UTC date and time is the right choice when you are matching a row to a log line from another system. The underlying timestamp does not change when you switch the format. The column does.
The timestamp is the capture machine’s clock at the moment the interface saw the frame. It is not a clock inside the packet, unless you are reading a protocol field that carries its own time. Two files from two laptops will not line up any closer than those two clocks agree. Write the time zone down.
Which gap you are measuring
frame.time_delta is the gap since the previous captured frame, whether or not that frame is on screen. frame.time_delta_displayed is the gap since the previous frame that passes the current display filter. With no filter, they match. With a filter that shows one host, they do not. The unfiltered delta is full of other people’s packets and looks like jitter that the conversation never had.
Seconds since the previous displayed packet, in the Time Display Format menu, points the time column at the displayed delta. Set that format after you apply the filter, or add frame.time_delta_displayed as a column so you can see both. A time reference, set with the menu or Ctrl+T on a selected frame, zeroes the displayed times at that row so a later event can be read as “four seconds after the SYN.”
Worked case: the gap in the backup stream
A lab backup from 10.8.0.40 to 10.8.0.20 looks bursty in the full file. You filter to that conversation with ip.addr == 10.8.0.40 && ip.addr == 10.8.0.20 && tcp.port == 445. Then you add frame.time_delta_displayed as a column. The gaps between packets of the backup are small. The long gaps you noticed earlier were other hosts’ frames sitting between them in the unfiltered list.
You set a time reference on the first frame of the backup. The time column now reads in seconds from that start, which is the number you put in the note: the transfer ran for 90 seconds of displayed time, with no displayed gap over 0.2 seconds. The capture’s wall clock still goes in the note as the absolute start, so it can be compared with the backup job’s log.
ip.addr == 10.8.0.40 && ip.addr == 10.8.0.20 && tcp.port == 445
Two files need two clocks
Merging two captures does not invent a shared clock. If one laptop was thirty seconds ahead, every cross-file comparison inherits that thirty seconds. Correct the clock in the notes, or in the timestamp shift for a file you have a reason to shift, and say that you shifted it. Silent alignment makes later math look more precise than the measurement was.
Protocol timestamps, such as an HTTP Date header or a TLS randomness field that is not a clock, are a different column of information. Prefer the capture timestamp for “when did this interface see it,” and prefer the log on the service for “when did the application think it happened.”
Diagram
Three ways to read the time column
- Clock
Choose seconds-from-start while you stay inside one file, or UTC when you must match a log.
- Filter
Apply the display filter for the conversation you are measuring.
- Delta
Read frame.time_delta_displayed. The unfiltered delta counts frames you hid.
frame.time_delta_displayed
- Reference
Set a time reference on the frame the story starts at, and read later rows from there.
What the time column is counting
- Since start
Seconds from the first frame. Stable inside one file. Hard to match to a remote log.
- UTC
The capture machine’s wall clock. Use it when a log line has a timestamp, and write the time zone down.
- Displayed delta
The gap since the previous row still on screen. This is the gap that respects your filter.
Check yourself
1. You filter to one TCP stream and want the gap between its packets. Which field do you read?
2. You switch the time column from “seconds since beginning” to UTC. What changed in the file?
3. You want every later row to read as seconds after the SYN in frame 50. What do you set?