This is our old Q&A Site. Please post any new questions and answers at

Can you please help to investigate for “Time delta from previous captured frame: 0.000000000 seconds” and “Time delta from previous displayed frame: 0.000000000 seconds” values.

the packets are not the first packet, I want to know that how wireshare show the time delta, get time of packet directly? this time is in interior of the original packet or laptop makes a timestamp while receive it?

asked 15 Oct '15, 19:38

tansg631's gravatar image

accept rate: 0%

I want to know why some packets with 0 time delta

(15 Oct '15, 19:38) tansg631

Could you provide us a trace?

(15 Oct '15, 22:05) Christian_R

Did you take the capture in a virtual system? If so, this can happen due to several reasons, related to virtualization.

(16 Oct '15, 03:10) Kurt Knochner ♦

It is possible for packet captures to not contain correct timestamps (ie: all zeros), particularly if they were imported from a text file or hex dump, where the dump didn't contain the time information. In such case, those time display settings won't help you because the information isn't actually there to be found in the file. In your example, if all the 'delta time' values are 0, then likely that is why.

How did you actually get the packet capture? Directly from a live capture on the laptop or from elsewhere?

permanent link

answered 15 Oct '15, 22:05

Quadratic's gravatar image

accept rate: 13%

edited 15 Oct '15, 22:09

thank you for you reply, I captured on live network, not all packets met this problem, just a few packets, the time delta is 0. do you mean the timestamp is in the packet in live network? wireshare just get timestamp and show it? or the timestamp is marked while arrived the laptop? thank you

(15 Oct '15, 23:55) tansg631

One reason could be that the time resolution inside the trace file is greater than the gap between two frames. But they should show the same absolute time value, in that case.

Remark: This could mainly caused by those things. - Common resolution of pcap is ms. - You switched the time format manually higher in Wireshark ( maybe you could post us two absolute time values) - The inter frame gap is 0 ns, this could theoretically happen in a full duplex trace

permanent link

answered 16 Oct '15, 00:37

Christian_R's gravatar image

accept rate: 16%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 15 Oct '15, 19:38

question was seen: 3,003 times

last updated: 16 Oct '15, 03:10

p​o​w​e​r​e​d by O​S​Q​A