[Guy Harris <gharris@xxxxxxxxx>]

rupesh gautam wrote:

> I want to improve packet drop in ethereal....can any one help me in 
> these questions.
>
> 1> What is ethereal packet capturing mechanism....

libpcap on UN*X and WinPcap on Windows.

> 2> How Can we improve ethereal for less packet drop

Shorten the code path involved in capturing (note that the code path 
includes OS kernel code used to write to the capture file, as well as 
the code path in the OS's packet capture mechanism, as used by libpcap, 
neither of which are part of Ethereal), or, once libpcap is changed to 
support setting the buffer size when capturing (which, due to the way 
BPF works, requires an API change so that the buffer size can be set 
when you open a device for capturing), make the "buffer size" option 
available on UN*X as well as Windows, and try using a bigger buffer size.