pyshark
pyshark copied to clipboard
Time since first frame seems to reset during capture?
Hi, I am using pyshark to process a packet capture done of a dhcp transition, so there are 4 unicast requests and then a broadcast request. I expect the time since first frame (in the udp layer) to increase for each subsequent packet, but consistently see that the final broadcast request has a "time since first frame" value less than the previous packet.
for pkt in capture:
... print(pkt.udp.time_relative)
0.000000000
60.341387000
68.555737000
84.582898000
4.882797000
Is there something that triggers the time counter to reset before the last packet? I am on OSX Ventura 13.0, pyshark 0.5.3.
When I use pkt.sniff_timestamp instead to calculate the "time since first frame" values, I get increasing values instead as I'd expect:
first_time = float(capture[0].sniff_timestamp)
for pkt in capture:
... print(float(pkt.sniff_timestamp) - first_time)
0.0
60.341387
68.555737
84.582898
90.00007400000001
Here is the attached pcap. out.pcap.gz
Thank you!