Hi Guys,

Hopefully this is not a duplicate question.

I always try to search before I post but there are so many ways that people can ask a question, all technically correct.

Using ble_sniffer_win_1.0.1 software, it appears that the timing of the packets being reported in Wireshark is incorrect.  I say this because i'm comparing to another sniffer (okay, you caught me -- the TI product).

For the Nordic sniffer, I'm using the nRF51 dongle.

As an example, I have a sniff I've done of simply listening to advertising from a board which is coming at 100mS intervals.   Instead of showing a steady stream of between 100 and 103mS, on the wireshark trace, I show some intervals of just a few mS, and then the normal, expected 100mS or so after that.

Example:
No.     Time        rto        Source                Destination           Protocol Length Info
    830 0.108450               Slave                 Master                LE LL    35     ADV_IND

Frame 830: 35 bytes on wire (280 bits), 35 bytes captured (280 bits) on interface 0
    Interface id: 0 (\\.\pipe\wireshark_nordic_ble)
    Encapsulation type: USER 10 (55)
    Arrival Time: Dec 31, 1969 19:01:24.193033000 Eastern Standard Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 84.193033000 seconds
    [Time delta from previous captured frame: 0.108450000 seconds]
    [Time delta from previous displayed frame: 0.108450000 seconds]
    [Time since reference or first frame: 58.003988000 seconds]
    Frame Number: 830
    Frame Length: 35 bytes (280 bits)
    Capture Length: 35 bytes (280 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: nordic_ble:btle:btcommon]
Nordic BLE sniffer meta
    board: 3
    uart packet counter: 17847
    flags: 0x01
    .... .0.. = encrypted: No
    .... ..0. = direction: Slave -> Master
    .... ...1 = CRC: OK
    channel: 37
    RSSI (dBm): -56
    delta time (us end to start): 107507
    delta time (us start to start): 107811
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    Packet Header: 0x0900 (PDU Type: ADV_IND, TxAdd=false, RxAdd=false)
    Advertising Address: TexasIns_ac:5f:0f (bc:6a:29:ac:5f:0f)
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x00
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x00)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x00)
            .... .1.. = BR/EDR Not Supported: true (0x01)
            .... ..0. = LE General Discoverable Mode: false (0x00)
            .... ...1 = LE Limited Discoverable Mode: true (0x01)
    CRC: 0x9c9804
        [Expert Info (Chat/Protocol): correct]

No.     Time        rto        Source                Destination           Protocol Length Info
    831 0.007681               Slave                 Master                LE LL    35     ADV_IND

Frame 831: 35 bytes on wire (280 bits), 35 bytes captured (280 bits) on interface 0
    Interface id: 0 (\\.\pipe\wireshark_nordic_ble)
    Encapsulation type: USER 10 (55)
    Arrival Time: Dec 31, 1969 19:01:24.200714000 Eastern Standard Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 84.200714000 seconds
    [Time delta from previous captured frame: 0.007681000 seconds]
    [Time delta from previous displayed frame: 0.007681000 seconds]
    [Time since reference or first frame: 58.011669000 seconds]
    Frame Number: 831
    Frame Length: 35 bytes (280 bits)
    Capture Length: 35 bytes (280 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: nordic_ble:btle:btcommon]
Nordic BLE sniffer meta
    board: 3
    uart packet counter: 17848
    flags: 0x01
    .... .0.. = encrypted: No
    .... ..0. = direction: Slave -> Master
    .... ...1 = CRC: OK
    channel: 38
    RSSI (dBm): -61
    delta time (us end to start): 393
    delta time (us start to start): 697
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    Packet Header: 0x0900 (PDU Type: ADV_IND, TxAdd=false, RxAdd=false)
    Advertising Address: TexasIns_ac:5f:0f (bc:6a:29:ac:5f:0f)
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x00
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x00)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x00)
            .... .1.. = BR/EDR Not Supported: true (0x01)
            .... ..0. = LE General Discoverable Mode: false (0x00)
            .... ...1 = LE Limited Discoverable Mode: true (0x01)
    CRC: 0x9c9804
        [Expert Info (Chat/Protocol): correct]

No.     Time        rto        Source                Destination           Protocol Length Info
    832 0.093336               Slave                 Master                LE LL    35     ADV_IND

Frame 832: 35 bytes on wire (280 bits), 35 bytes captured (280 bits) on interface 0
    Interface id: 0 (\\.\pipe\wireshark_nordic_ble)
    Encapsulation type: USER 10 (55)
    Arrival Time: Dec 31, 1969 19:01:24.294050000 Eastern Standard Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 84.294050000 seconds
    [Time delta from previous captured frame: 0.093336000 seconds]
    [Time delta from previous displayed frame: 0.093336000 seconds]
    [Time since reference or first frame: 58.105005000 seconds]
    Frame Number: 832
    Frame Length: 35 bytes (280 bits)
    Capture Length: 35 bytes (280 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: nordic_ble:btle:btcommon]
Nordic BLE sniffer meta
    board: 3
    uart packet counter: 17849
    flags: 0x01
    .... .0.. = encrypted: No
    .... ..0. = direction: Slave -> Master
    .... ...1 = CRC: OK
    channel: 39
    RSSI (dBm): -68
    delta time (us end to start): 101018
    delta time (us start to start): 101322
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    Packet Header: 0x0900 (PDU Type: ADV_IND, TxAdd=false, RxAdd=false)
    Advertising Address: TexasIns_ac:5f:0f (bc:6a:29:ac:5f:0f)
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x00
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x00)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x00)
            .... .1.. = BR/EDR Not Supported: true (0x01)
            .... ..0. = LE General Discoverable Mode: false (0x00)
            .... ...1 = LE Limited Discoverable Mode: true (0x01)
    CRC: 0x9c9804
        [Expert Info (Chat/Protocol): correct]

No.     Time        rto        Source                Destination           Protocol Length Info
    833 0.106963               Slave                 Master                LE LL    35     ADV_IND

Frame 833: 35 bytes on wire (280 bits), 35 bytes captured (280 bits) on interface 0
    Interface id: 0 (\\.\pipe\wireshark_nordic_ble)
    Encapsulation type: USER 10 (55)
    Arrival Time: Dec 31, 1969 19:01:24.401013000 Eastern Standard Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 84.401013000 seconds
    [Time delta from previous captured frame: 0.106963000 seconds]
    [Time delta from previous displayed frame: 0.106963000 seconds]
    [Time since reference or first frame: 58.211968000 seconds]
    Frame Number: 833
    Frame Length: 35 bytes (280 bits)
    Capture Length: 35 bytes (280 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: nordic_ble:btle:btcommon]
Nordic BLE sniffer meta
    board: 3
    uart packet counter: 17850
    flags: 0x01
    .... .0.. = encrypted: No
    .... ..0. = direction: Slave -> Master
    .... ...1 = CRC: OK
    channel: 37
    RSSI (dBm): -56
    delta time (us end to start): 106882
    delta time (us start to start): 107186
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    Packet Header: 0x0900 (PDU Type: ADV_IND, TxAdd=false, RxAdd=false)
    Advertising Address: TexasIns_ac:5f:0f (bc:6a:29:ac:5f:0f)
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x00
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x00)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x00)
            .... .1.. = BR/EDR Not Supported: true (0x01)
            .... ..0. = LE General Discoverable Mode: false (0x00)
            .... ...1 = LE Limited Discoverable Mode: true (0x01)
    CRC: 0x9c9804
        [Expert Info (Chat/Protocol): correct]

No.     Time        rto        Source                Destination           Protocol Length Info
    834 0.008154               Slave                 Master                LE LL    35     ADV_IND

Frame 834: 35 bytes on wire (280 bits), 35 bytes captured (280 bits) on interface 0
    Interface id: 0 (\\.\pipe\wireshark_nordic_ble)
    Encapsulation type: USER 10 (55)
    Arrival Time: Dec 31, 1969 19:01:24.409167000 Eastern Standard Time
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 84.409167000 seconds
    [Time delta from previous captured frame: 0.008154000 seconds]
    [Time delta from previous displayed frame: 0.008154000 seconds]
    [Time since reference or first frame: 58.220122000 seconds]
    Frame Number: 834
    Frame Length: 35 bytes (280 bits)
    Capture Length: 35 bytes (280 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: nordic_ble:btle:btcommon]
Nordic BLE sniffer meta
    board: 3
    uart packet counter: 17851
    flags: 0x01
    .... .0.. = encrypted: No
    .... ..0. = direction: Slave -> Master
    .... ...1 = CRC: OK
    channel: 38
    RSSI (dBm): -61
    delta time (us end to start): 393
    delta time (us start to start): 697
Bluetooth Low Energy Link Layer
    Access Address: 0x8e89bed6
    Packet Header: 0x0900 (PDU Type: ADV_IND, TxAdd=false, RxAdd=false)
    Advertising Address: TexasIns_ac:5f:0f (bc:6a:29:ac:5f:0f)
    Advertising Data
        Flags
            Length: 2
            Type: Flags (0x01)
            000. .... = Reserved: 0x00
            ...0 .... = Simultaneous LE and BR/EDR to Same Device Capable (Host): false (0x00)
            .... 0... = Simultaneous LE and BR/EDR to Same Device Capable (Controller): false (0x00)
            .... .1.. = BR/EDR Not Supported: true (0x01)
            .... ..0. = LE General Discoverable Mode: false (0x00)
            .... ...1 = LE Limited Discoverable Mode: true (0x01)
    CRC: 0x9c9804
        [Expert Info (Chat/Protocol): correct]

Is the strange timing expected?  Just an outgrowth of using pipes?

Has anyone done anything to correct it?  Could a different set of hardware help the problem?  Could this be tied into the exact USB port I'm using, machine configuration or something else?
I can certainly say that I have not been very careful in setting up this machine, but the TI sniffer dongle doesn't report the same instability in the timing.

Or is this not duplicated in your labs? 

I'd like to be able to count on my sniffer tools, if at all possible, for ground-truth data.

-thanks
-e