Ethereal-users: RE: [Ethereal-users] Dropped packets while Capturing to a File -How can I tell??
OK, so...
The only way for me to know if packets were dropped during a capture, is
to look at the status line at the bottom of the screen after a capture
finishes, right?
And, am I correct in inferring that, if Ethereal *wanted* to include
information on 'drops' in the capture file, this would conflict with the
libpcap file format, and would make Ethereal capture files unreadable by
other tools? Is that the issue?
Thx again,
Michael
Michael Feeny
TDDS Application Integration Management
609-274-2761 (Office)
484-995-1745 (Mobile)
1-888-MERRIL0 (Page)
feenyman99 (AIM)
-----Original Message-----
From: ethereal-users-bounces@xxxxxxxxxxxx
[mailto:ethereal-users-bounces@xxxxxxxxxxxx] On Behalf Of Ulf Lamping
Sent: Monday, January 09, 2006 8:39 PM
To: Ethereal user support
Subject: Re: [Ethereal-users] Dropped packets while Capturing to a File
-How can I tell??
Feeny, Michael (TD&DS, Applications Infrastructure Svcs.) wrote:
> Hi,
>
> I am capturing with Ethereal (0.10.13) on a virtual Windows 2000
> server, which is running atop VMWare, and Ethereal is experiencing
> packet drops. This is based on seeing "Drops: 522" at the bottom of
> capture screen, and from numerous "Previous Segment Lost" warnings
> within the packet list.
>
> After reading the Ethereal Performance Wiki, I will try increasing the
> buffer size (it's only 1MB now), and I'm hoping this will improve
> things. But my question involves recognizing packet drops in a capture
> file.
>
> I almost always capture to files, and then analyze the files later.
> Had I not seen the "Drops: 522" at the bottom of the screen, I would
> not have realized packets were getting dropped. Is there any way, when
> looking at a capture file created by Ethereal, to know if packets were
> dropped? From the "Drops: 522" message, it seems that Ethereal
> recognizes drops when they occur. Does Ethereal indicate drops in the
> capture file??? (I looked, but I did not find such an indication.)
>
No, Ethereal don't indicate packet drops any further as the libpcap file
format doesn't keep this information.
Regards, ULFL
_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users
--------------------------------------------------------
If you are not an intended recipient of this e-mail, please notify the sender, delete it and do not read, act upon, print, disclose, copy, retain or redistribute it. Click here for important additional terms relating to this e-mail. http://www.ml.com/email_terms/
--------------------------------------------------------
