> Because TShark does more work on the packets if you're asking it to
> dissect every single packet (which is what it does in that case - it
> has to do that in order to calculate RTP statistics) than tcpdump does
> if you have it just write the packets out to a file.
While running "top" on the linux machine 50% of the processor is occupied. So the processor doesn't seem to get overloaded.
Is the problems buffers in Linux? If so which do you think are overflowed?
> Try
>
> tshark -i 6 -c 5000 -d udp.port==1234,rtp -z rtp,streams udp port 1234
>
> which *does* have a (capture) filter, "udp port 1234". No guarantees
> that all the per-packet work done by TShark can be done quickly enough
> not to drop packets.
This doesn't help...
check out the rest of the Windows Live™.
More than mail–Windows Live™ goes way beyond your inbox.
More than messages
|