> By 'calculate the latency' do you mean that the packets in question are going between two particular machines, and the two captures were done on those machines, and, for each of those packets, you want the difference between the time stamp for that packet in the capture done on the machine that sent the packet and the time stamp for that packet in the capture done on the machine that received the packet? > Is there a program available that will compare two pcap files and calculate the latency of specific packets, assuming that the clocks on the two machines that created the pcap files are synchronized? May need to enable these as a privileged admin. One other thing when using TCP is the TCP timestamp option. Other request/responses such as DNS or SIP that hopefully have only a Of course if you are not using ICMP or TCP you may need to look at (As you have captured traffic at both ends you can probably OSes, there will be very little delay attributable due to context As this is handled in the IP stack within the kernel on all The one I use is the SYN request and the SYN-ACK However if you haven't injected ICMP you probably want to look forīuilt-in mechanisms. The most elementary one that people use of course is ping, or ICMP Some form of request leaving and it's related response being returned. The best way to measure network latency is to look at time between

As Guy has said, you can't use the absolute times unless you canĮnsure the machines at each end are millisecond synchronised.

Compare 2 pcap wireshark