Ethereal-users: Re: [Ethereal-users] traffic analysis, help please
Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.
Brian Davidson wrote:
Okay, I see that a TCP Packet was lost, but I guess I want a fuller
definition of the word "lost". Yes, the packet might actually not be
there. Beyond that, how likely is it that the traffic was so heavy on
the line that Ethereal did not have resources to capture and save it? I
need to know if "TCP Previous Segment Lost" means absolutely that it was
missing, rather than "slipped past while Ethereal was busy". Is there
some other indicater in the capture file that traffic volume got high
enough to affect the ability to record?
Unfortunately, there isn't. The "next-generation" version of the
libpcap format that's our native capture file format will
1) have the ability to put into the capture file a "statistics" record
indicating how many packets were reported by the host OS software
Ethereal uses to capture as having been received but discarded because
the buffer for captured packets was full (note that some host OS
software might not provide this)
and
2) have the ability to record, for each packet, the number of packets
discarded for that reason since the previous packet *if* the host OS
makes that available (which, again, it might not be).
Even from that you can't know whether a lost segment was one of the
packets discarded by the host OS software. If you're capturing traffic
that is being sent to the machine doing the capture, note that a TCP
segment packet might be be processed by the host TCP stack, and the data
in the segment supplied to whatever application is reading from the TCP
connection, *and* discarded by the capture code, because the capture
code might be capturing *all* packets and the buffer used by *it* might
not be large enough, or the program doing the capturing might not be
emptying it fast enough.
On OSes where the information for (1) is available, if you capture with
Ethereal, when the capture finishes it should report the total number of
packets discarded ("Drops") in the left-hand box in the status bar at
the bottom of the display. That's not stored in the capture file, however.