Showing results for 
Show  only  | Search instead for 
Did you mean: 

This product reached the end of support date on March 31, 2021.

Time Sync on Merged Traces



I opened the following as a ticket with support. The tech, @Tomasz S., requested I post to the forum for more input.

In the past I've used TTA 12.x for performing traces from a single
probe. We are testing DNA 12.4 and we would like to capture from 2-3
NetworkVantage probes simultaneously. Is there a best practice to sync
the clocks and/or traces between the 2-3 NV devices so merging there
will be little or no "Network: TCP Frame Out of Sequence, Network: TCP Missing Data" error messages in the merged capture?

The NV probes will be located in 3 separate data centers. One of the
NV probes will double as the test PC where the application commands will
be run via RDP.

Thanks and God bless,




Thanks Genesius!

I seem to remember that a long time ago, the Agent Manager did the time synch, at least when you did an attended capture with multiple agents - @Tomasz S. can you check with Gary or some other if this was so or I was just dreaming?

Hmm, I'm not sure if Agent Manager was ever used for such scenarios, it is an old tool for changing promiscuous mode, changing password or resetting an agent. Agent Commander is a more powerful and modern tool for these jobs.

You're probably referring to Attended Capture - it does synchronize clocks with the agents, but only to make up for time zone differences, I think. I may take a look at the source code, though, to confirm.

In case of Attended Capture time is synchronized between capture points or actually DNA measures capture start time offset between all of them, so it can properly match packets during merge phase - Merge wizard - Time offsets

So it's a one-time sychronization only, right? Does not take into consideration slower/faster clocks, as in virtual machines for example?


It seems you’re referring to DNA agents, not NetworkVantage agents? I
have never had anything to do with the latter, they sound like an old

When it comes to time synchronization, there are several points worth considering.

  1. Attended Capture allows you to enable ALD (Active Latency
    Detection) which helps getting more insight into packets on both
    communicating parties and handle time differences. This is a
    recommendation if you think of merging traces after capture.
  2. It is always a good idea to enable a time synchronization service
    on each machine where traces are to be captured (and accurate timestamps
    are a must). Consider enabling NTP on each agent and the console. Some
    useful hints are described here:
  3. If the console or some of the agents are installed on a VMware
    Virtual Machine, then an additional effort may be necessary to mitigate
    host overload problems. Read more about this is important and how to
    enable hardware-based timekeeping in VMware virtual environments here:


I moved my answer to a post below. Thanks for reaching for the Community's collective knowledge, Genesius!