Hi What is the difference between seconds since previous captured packet vs seconds since previous Display packet. what does it mean captured packet and display packet. thanks asked 06 Feb '14, 21:57  scara |
One Answer:
Simply the following: If you've applied a display filter so that not all of the frames are being displayed in the summary pane, then the "time since" which is shown can be set to be the "time since the frame which is displayed before this one" or the "time since the previous captured frame" (even if not displayed). Try both with a display filter applied; you'll see the difference. answered 06 Feb '14, 22:15  Bill Meier ♦♦ |
If an answer has solved your issue, please accept the answer for the benefit of other users by clicking the checkmark icon next to the answer. Please read the FAQ for more information.
Hi i am not applying any filters here if you go to View>Time Display format> there are different formats for time. in that you have "seconds since previous captured packet" and "seconds since previous Display packet"
"seconds since previous Display packet" will only have an effect if you apply a filter.
See also the manual: http://www.wireshark.org/docs/wsug_html_chunked/ChWorkTimeFormatsSection.html
If you have no filters applied then the two time options are equivalent since the previous displayed packet will be the same as the previous captured packet.
With a filter applied this might not be the case as the previous captured packet may not be displayed by the filter.