Ethereal-users: Re: [Ethereal-users] MacOS X issues...
> I am running Ethereal on MacOS 10.1.2 and having problems receiving packets
> in realtime. What I am seeing looks like Ethereal (or some entity) is
> buffering *alot* of packets before finally updating the display capture
> window.
How many is "a lot"?
Ethereal *does* deliberately not update packet displays instantaneously,
so as not to overload slow displays; there's a 1-second delay.
In addition, it also deliberately asks the libpcap to, if the underlying
packet capture mechanism libpcap uses supports that notion, buffer
packets for 1/4 second so that libpcap gets more than one frame per
read...
...except on a certain BSD-based system from Cupertino, California,
where an apparent bug in the underlying packet capture mechanism appears
to cause buffering for less than 1 second not to work, in which case it
asks the underlying packet capture mechanism to buffer for 1 second.
We could, I guess, dynamically adjust the delays to larger values when
there's heavy network traffic and smaller values when there's light
network traffic, but I've not seen any signs of anybody volunteering to
do it - I sure don't have the free time to do it so, unless you
implement it and it's acceptable for the source base, that behavior
might not change for a while.
