8.8. Compare two capture files
From Wireshark
Compare two capture files.
This feature works best when you have merged two capture files chronologically, one from each side of a client/server connection.
The merged capture data is checked for missing packets. If a matching connection is found it is checked for:
-
IP header checksums
-
Excessive delay (defined by the "Time variance" setting)
-
Packet order
You can configure the following:
-
Start compare: Start comparing when this many IP IDs are matched. A zero value starts comparing immediately.
-
Stop compare: Stop comparing when we can no longer match this many IP IDs. Zero always compares.
-
Endpoint distinction: Use MAC addresses or IP time-to-live values to determine connection endpoints.
-
Check order: Check for the same IP ID in the previous packet at each end.
-
Time variance: Trigger an error if the packet arrives this many milliseconds after the average delay.
-
Filter: Limit comparison to packets that match this display filter.
The info column contains new numbering so the same packets are parallel.
The color filtering differentiate the two files from each other. A “zebra” effect is create if the Info column is sorted.
![[Tip]](/Wireshark/tip.png){kind=small}
|
Tip! |
|---|---|
|
If you click on an item in the error list its corresponding packet will be selected in the main window. |