Wireshark-bugs: [Wireshark-bugs] [Bug 1181] Delays in real-time packet capture
Date: Tue, 21 Nov 2006 10:08:16 +0000 (GMT)
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1181


hgsft4z02@xxxxxxxxxxxxxx changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|                            |FIXED




------- Comment #6 from hgsft4z02@xxxxxxxxxxxxxx  2006-11-21 10:08 GMT -------
Jim Young writes:
> One of the primary reasons for the introduction of the dumpcap utility 
> was to minimize the number of dropped packets.

I've tested that this "not showing last packets" behavior started somewhere
between ethereal version 0.10.13-1.1 and wireshark 0.99.2-1 (debian etch
version numbers). According to your explanation, it sounds to me as if this
behavior change is explained by ethereal/wireshark changing to use dumpcap in a
revision between these two versions. Is that right?

Is it easy to revert back to the "old" behavior? I consider this new behavior
much worse than loosing packets at high load which is likely to happen anyway.
Wouldn't most folks agree?

---

Presumably this bug was introduced somewhere between rev. 16130 and 18754, but
I don't know which...

svn releases/0.10.13 and releases/wireshark-0.99.2/ svn log --stop-on-copy
info:

r16131 | gerald | 2005-10-05 21:19:04 +0200 (Wed, 05 Oct 2005) | 3 lines
Changed paths:
   A /releases/ethereal-0.10.13 (from /trunk:16130)

r18755 | gerald | 2006-07-18 00:32:06 +0200 (Tue, 18 Jul 2006) | 2 lines
Changed paths:
   A /releases/wireshark-0.99.2 (from /trunk-0.99.2:18754)


-- 
Configure bugmail: http://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.