Wireshark-users: Re: [Wireshark-users] Packets not captured, tcp acking lost segments. Large pack

From: Michael Lynch <michaellynch511@xxxxxxxxx>
Date: Sun, 9 Jan 2011 05:02:02 +1100
Thanks Sake

I'll pop in there and let them know

It was win 7, dell opti 780 with broadcom.

Regards

On 08/01/2011, at 10:14 PM, Sake Blok <sake@xxxxxxxxxx> wrote:

On 8 jan 2011, at 11:40, Michael Lynch wrote:

God I hope IPv6 is simpler!!

In some ways it is, but in most ways it isn't, you're in for a treat :-)

Laura mentions that her Wireshark did pick up these LSO packets in the trace, so I guess I was just unlucky. As Graham suggested, I will give a try the "Edit | Preferences | Expand Protocols and find IP | Check "Support packet-capture from IP TSO-enabled hardware". I'll let you know if that options resolves the incomplete capture trace.

It won't, the protocol options only have effect on the way Wireshark interprets and displays the captured data not on which packets will be captured.

If the large frames were not captured, they were not captured. It is however interesting to see that netmon on the same machine was able to capture them, while wireshark wasn't. This can be caused by the fact that they both use a different way of getting the packets of the networking stack. Since Wireshark uses WinPcap on windows systems, that's where this could be solved. You might want to address this at the WinPcap mailinglist to improve the WinPcap library to be able to capture large frames in your particular setup (which must also be used by other people).

Cheers,


Sake


___________________________________________________________________________


Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx >
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe