Here is a hint on how to get more out of Ethereal/Wireshark. For information on
constructing dissectors for complex protocols, see my
Ethereal Stuff page.
It can sometimes be very helpful to have two time columns showing. One as an absolute offset from the first packet, the other as a delta from the previous packet.
To do this, change the column.format entry in your preferences file (.ethereal/preferences) to the following:
# Packet list column format. Each pair of strings consists of a column title
# and its format.
column.format: "No.", "%m", "Time", "%t", "Delta Time", "%Tt", "Source",
"%s", "Destination", "%d", "Protocol", "%p", "Info", "%i"
Actually, the important bit is to have the "Delta Time", "%Tt" piece in addition to what you already have.
|