Wireshark-users: Re: [Wireshark-users] tshark packets droppped
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Thu, 07 Jan 2010 12:52:59 -0500
David wrote:

When I run tshark sometime I get  "xxxx packets dropped" at the end of
the session.    Does this mean the wireshark is dropping the packets
or the capture NIC is overrun or something else?
It means the NIC received the packets but the capturing mechanism (libpcap + Wireshark) couldn't keep up.
You might want to try capturing with 'dumpcap' instead to see if it can keep up with your traffic rate.