Wireshark · Wireshark-users: Re: [Wireshark-users] Query regarding Wireshark

[Martin Visser <martinvisser99@xxxxxxxxx>]

Hmmm, obviously even on a multi-core machine the network drivers must be able to present packets to the OS network stack in the order on the wire. What mechanism allows libpcap to do thing in a different order. If what you are saying is correct, that has to be a major issue in libpcap?

Regards, Martin

MartinVisser99@xxxxxxxxx

On 26 March 2011 03:46, Guy Harris <guy@xxxxxxxxxxxx> wrote:

On Mar 24, 2011, at 9:57 AM, Gurpreet Singh wrote:

> It is not a defect but i couldn't find any forum where I can ask this question.

This is probably a good place to ask this question; another place might be ask.wireshark.org.

> I am monitoring Eth3 of 2 machines.
> 1st machine is sending the RLP(Radio Link Protocol) messages.
> 2nd machine receives the RLP Messages.
> Data rate would ne 30-40 MBps
>
> Problem:
> Order of the packet on Machine 2 is not same as Machine 1.
> Is there any guarantee that wireshark will display the packets in the same
> order as the order of the packets on the wire?

Wireshark will, by default, display the packets in the same order that they are delivered to whatever capture mechanism libpcap uses on UN*X and to NDIS (as used by WinPcap) on Windows.  That may, or may not, be the same order of the packets on the wire, especially on multi-core machines.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe