2

I'm getting the same data (UDP packets) from two different sources (on 2 different NICs). I'd like to figure out if one source is "faster" than the other, by comparing the reception timestamps packet by packet.

to do so, I plan to snoop both interfaces at the same time, reconcile packets, and compare timestamps accordingly.

however I'm having issues with the output of snoop: in order to reconcile each packet properly, I would need to have "one line" of data per packet, but the different snoop options I found are not giving me that. the closest I could find is "snoop -x 0" that will display in both hexadecimal and ascii, but I don't need hexa, and I need the ascii on one single line...

any idea on how to achieve this ?

Improve this question
1
  • What options are you using with snoop ? Please post a sample output of what you get with them and would like to see in a single line.
    – jlliagre
    Oct 7, 2010 at 4:18

2 Answers 2

Reset to default
1

Tell snoop to write the packets to a file (-o file) and load it with Wireshark.

If you're going to sniff for a long period of time and you're not interested in the packets' actual contents, tell snoop to limit it to the first X bytes so you only record the headers (eg. -s 120).

Improve this answer
1

Wireshark allows to capture packets from multiple interfaces so you might use it in the first place if installed on your server. Should you want to analyse and merge existing captures, it is also able to consolidate them as explained here: http://www.wireshark.org/docs/wsug_html_chunked/ChIOMergeSection.html

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .