Setting the probe’s time clock synchronization settings
At times your capture card drivers time clock may drift. They can be synchronized with the system clock, if you wish. Unless you notice a reason to enable this feature, we recommend that you do not synchronize your capture card’s time clock.
Some Other things to consider:
The capture card synchronizes itself with the system clock at when the system starts.
Generally, you are interested in relative time between packets, not the actual time a packet was seen.
1. Do one of the following:
On the probe: Click the Synchronization tab.
In Observer: Select a probe instance, right-click and choose Administer Selected Probe. Then click the Synchronization tab.
2. Click the Edit Schedule button.
3. Choose when and how you want the capture card’s time clock to synchronize with the system clock and click OK.
Daylight Savings Time
Observer is not coded with a specific date in mind. Daylight Savings Time is controlled by the operating system. When the clock rolls backwards or forwards Observer rolls with it, with one exception: packet capture/decode.
Packet capture provides nanosecond time resolution, which none of the rest of the product does. Because of this, packet capture does not rely on the system clock to provide time stamps. It relies on the processor time ticks. When Observer opens it requests the system time and the number of processor time ticks and uses those. This allows Observer to know what date and time it is when a packet is seen.
Because the Observer only asks the operating system for the system time when Observer is started, packet capture does not know that the time has jumped forward or backward. To get this to happen you need restart Observer after the time change. It is that simple.