Wireshark WCNA Exam - Topic 4 Question 25 Discussion

Actual exam question for Wireshark's WCNA exam

Question #: 25
Topic #: 4

[All WCNA Questions]

Which statement about packet timestamps is correct?

ASorting on packet timestamps alters the packet numbers in the trace file.

BPacket timestamps for pcap files can denote time to the nanosecond level.

CYou can alter packet timestamps of separate packets in a trace file using Editcap.

DPacket timestamps are provided by WinPcap, libpcap, or AirPcap at the time packets are captured.

Show Suggested Answer

Suggested Answer: D

by Nieves at Apr 07, 2026, 09:28 AM

Limited Time Offer

25%

Off

Contribute your Thoughts:

Submit Cancel

18 days ago

Totally agree with D, timestamps are captured in real-time.

upvoted 0 times

...

23 days ago

B is correct, pcap files can have nanosecond precision.

upvoted 0 times

...

1 month ago

I vaguely recall something about sorting affecting packet numbers, which makes me lean towards option A being true, but I need to double-check that.

upvoted 0 times

...

1 month ago

I practiced a similar question about packet timestamps last week, and I remember that altering timestamps is possible, so option C could be right.

upvoted 0 times

...

2 months ago

I'm not entirely sure, but I feel like option B might be incorrect since I thought pcap files had limitations on timestamp precision.

upvoted 0 times

...

2 months ago

I think option D sounds familiar because I remember reading that timestamps are generated during the capture process.

upvoted 0 times

...