Question of reading packages in Ethereal/Wireshak, that were collected from PAA:
When a read or write command comes in --- the first SCSI request package and the last SCSI complete package has high possibility not in the same capture file, especially when the capture file is not big.
Then I will see: [time from Exchange First: -5.763400000 seconds]
Does that mean total complete time is 5.7634 seconds???
I went back to 5-6 seconds from that frame, but could not find the first frame. So I was wondering maybe -5.7634 seconds does not really mean it. Do I need to do some kind of math to find the first request frame in previous files???