Ethereal-dev: Re: [Ethereal-dev] EtherReal 0.9 bug -- Mac OSX

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Fri, 25 Jan 2002 00:43:56 -0800
On Thu, Jan 24, 2002 at 06:28:51PM -0800, Philip Rakity wrote:
> b) Select show frames in real time....  They come in in bursts.  Its as if
> someone is buffering the data before handing a set of frames to etherreal.

Ethereal, when opening the capture stream, specifies a "timeout" of 250
milliseconds (1/4 second) - on some platforms (including platforms using
BPF, of which MacOS X is, not surprisingly, one), this means that
packets may be buffered for up to 1/4 second before Ethereal receives
them (so that it can get more than one packet per read, for efficiency
reasons).

In addition, the mechanism by which, in an "Update list of packets in
real time" capture, the child process doing the capture sends a message
to the parent process telling it that more packets have arrived causes
updates to be done only once a second - and, in all captures, the
updates to the counts of packets is also done only once per second, "so
as not to overload slow displays" (to quote the comment in the code).