[Claus Wagner <Claus.Wagner@xxxxxxxx>]

Guy Harris wrote:
> 
> > I obtained an strace log but it is rather large. For six ping calls it
> > is about 250 kB. What do I have to look for in these files?
> 
> Look for "recvfrom()" calls made by Ethereal, and see if they're
> immediately preceded by "select()" or "poll()" calls.

Yes, all recvfrom()s are preceded by a poll(), which returns 1 in each
case.

> (Oh, and, if you do this, make sure you'd run Ethereal with name
> resolution turned off; I'm not sure which particular call the DNS or NIS
> name-lookup code uses to read replies, but I'd rather not have to worry
> about whether the "recvfrom()" is receiving a packet from the socket
> it's using for snooping or from a socket it's using for making requests
> over the network.)

That's it! When I turn off name resolution, everything is fine. And I
observed the following: When name resolution is turned on, every second
call is a DNS, i.e., DNS, IP, ICMP, DNS, IP, ICMP, DNS... (maybe my
stack is misconfigured, or their stack is misconfigured?) Disabling name
resolution gives: DNS, IP, ICMP, IP, ICMP...

A side effect: I played a while with name resolution on, and off, and
on, and off again and so on. Then I got "File<capture>Drops: 0" in the
lower right panel. After closing ethereal and starting again, everything
works fine again.

Regards
Claus