[Jim Aragon <Jim@xxxxxxxxxxxxxxxxx>]

At 06:23 AM 10/30/2011, Stuard Kendrick wrote:

>Is there any performance advantage to using dumpcap over tshark,
for
>pure packet capture?  [Less chance of dropping frames
perhaps?]

Probably. Tshark calls dumpcap to do the packet capture. So if you run
tshark, you're running tshark and dumpcap. If you run dumpcap directly,
you're only running dumpcap. At the very least, it seems to me that
dumpcap would use less memory than dumpcap and tshark together.

Jim