Ethereal-users: [Ethereal-users] loopback capture results different between ethereal and tcpdump

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Brad Lyon <bradlyon@xxxxxxxxx>
Date: Thu, 04 Dec 2003 21:51:57 -0500
I couldn't find this in the FAQ.  I'm using 0.9.8 at the moment on linux
(I'll upgrade tomorrow).  I was investigating some stuff that's using
the loopback interface under short-term heavy load, and noticed that
ethereal and tcpdump get different results: tcpdump listed about 3 times
as many packets as got captured with ethereal.  There are no filters or
anything fancy.

Is this a case of something getting overwhelmed inside the aux libraries?

Also - even tcpdump can't keep up with the count of packets sent as
indicated by /proc/net/dev - I assume this is related to the same issue.

TIA.  Please feel free to point me at a FAQ or something obvious I've
missed.

f