ntp time offset

[DraganSkundric87318]

hi,

I have two routers that are part of asymtric connection toward exernal partner. Sometimes traffic from one sesion goes over one router and returnes over another and that is fine. I have monitor capture session that captures some traffic and because of slight time offset it is complicated to merge these two captures into one. Question is ... how can I get rid of this small few ms time offset? Routers uses same NTP server as source.

br

[David Ruess]

Hello,

You can see if making them NTP peers of each other. If I remember correctly the "peering" should help them sync with eachother.

You can point one to the NTP server and the other router points to the router peering with the NTP server to sync its time.

ntp peer x.x.x.x

-David

[DraganSkundric87318]

thi si plan B, But I'd like to solve it generally if possible

[pieterh]

how is the merge complicated ?
https://www.wireshark.org/docs/wsug_html_chunked/ChIOMergeSection.html

Merge chronologically

Merge both the packets from the selected and currently loaded file in chronological order.

unless the time difference fluctuates frequently (including negatives ),
the merge should be sufficient to produce a consistend capture file for analisys ?
if it does fluctuate, you need to inspect your NTP servers function.

[DraganSkundric87318]

because of time difference packets are not ordered in perfect order

[pieterh]

as you are talking about "small few ms time offset" and this is still too large an interval,
I would choose David's option what you call plan-B syncing with eachother

other idea could be changing the sync interval to your primary NTP-source, so the accumulated drift after sync will be less.
by the way, NTP also has a broadcast option , if you do not need securing your ntp environment tightly , this could be an option?