Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm getting the same data (UDP packets) from two different sources (on 2 different NICs). I'd like to figure out if one source is "faster" than the other, by comparing the reception timestamps packet by packet.

to do so, I plan to snoop both interfaces at the same time, reconcile packets, and compare timestamps accordingly.

however I'm having issues with the output of snoop: in order to reconcile each packet properly, I would need to have "one line" of data per packet, but the different snoop options I found are not giving me that. the closest I could find is "snoop -x 0" that will display in both hexadecimal and ascii, but I don't need hexa, and I need the ascii on one single line...

any idea on how to achieve this ?

share|improve this question
What options are you using with snoop ? Please post a sample output of what you get with them and would like to see in a single line. – jlliagre Oct 7 '10 at 4:18

Tell snoop to write the packets to a file (-o file) and load it with Wireshark.

If you're going to sniff for a long period of time and you're not interested in the packets' actual contents, tell snoop to limit it to the first X bytes so you only record the headers (eg. -s 120).

share|improve this answer

Wireshark allows to capture packets from multiple interfaces so you might use it in the first place if installed on your server. Should you want to analyse and merge existing captures, it is also able to consolidate them as explained here:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.