pyshark icon indicating copy to clipboard operation
pyshark copied to clipboard

Time since first frame seems to reset during capture?

Open atmalagon opened this issue 2 years ago • 1 comments

Hi, I am using pyshark to process a packet capture done of a dhcp transition, so there are 4 unicast requests and then a broadcast request. I expect the time since first frame (in the udp layer) to increase for each subsequent packet, but consistently see that the final broadcast request has a "time since first frame" value less than the previous packet.

for pkt in capture:
...     print(pkt.udp.time_relative)

0.000000000
60.341387000
68.555737000
84.582898000
4.882797000

Is there something that triggers the time counter to reset before the last packet? I am on OSX Ventura 13.0, pyshark 0.5.3.

When I use pkt.sniff_timestamp instead to calculate the "time since first frame" values, I get increasing values instead as I'd expect:

first_time = float(capture[0].sniff_timestamp)
for pkt in capture:
...     print(float(pkt.sniff_timestamp) - first_time)

0.0
60.341387
68.555737
84.582898
90.00007400000001

Here is the attached pcap. out.pcap.gz

Thank you!

atmalagon avatar Jan 04 '23 15:01 atmalagon