On Jan 14, 2009, at 9:04 PM, Tal Rusak wrote:
In Wireshark, while my host was loading several webpages with many
graphics, etc. I am only seeing about 200 TCP and 200 UPD packets, 3
ARPS, the rest "others".
200+200+3 > 0, so
However, now I am only picking
up packets of type "Other" when sniffing on mon0.
and
"Other" are just 802.11 beacons for the most part--none of the
colored packets, UDP, TCP, ect. are showing up anymore.
appears to be misstatements of the problem - you're *not* only picking
up packets of type "Other", you're picking up *mostly* packets of type
"Other" but are *still* seeing UDP and TCP and... packets.
I think there should be more.
Perhaps the problem is that there are too many packets being received
and libpcap+dumpcap can't read them fast enough and some are getting
dropped. If most of them are beacons and control packets, losing a
given percentage of all packets might still leave plenty of beacons
and control packets but leave fewer data packets (and, in addition, it
might be harder to tell by looking at a capture whether you've lost
beacons or control packets).
In tcpdump, it is harder to tell, but there are very few data
packets
Again, "very few" > "none".
You might try downloading libpcap 1.0.0 from
http://www.tcpdump.org/release/libpcap-1.0.0.tar.gz
and tcpdump 4.0.0 from
http://www.tcpdump.org/release/tcpdump-4.0.0.tar.gz
Unpack them both in the same parent directory, configure and build
libpcap, configure and build tcpdump, make sure that when you run
"tcpdump -h" it reports
tcpdump version 4.0.0
libpcap version 1.0.0
and then try doing
tcpdump -i mon0 -s 0 -w /tmp/capture.pcap
while the other host is loading the Web pages. Then see whether,
after you type ^C to stop tcpdump, whether it reports any packets
"dropped by kernel", and read /tmp/capture.pcap with Wireshark.
libpcap 1.0.0 can do memory-mapped captures on Linux, which might
reduce the number of packet drops (by allocating a bigger buffer than
the default socket buffer, and by avoiding some packet capturing and
*perhaps* allowing multiple packets to be read per wakeup), and it
might also do a better job of getting capture statistics - including
packet drop counts.