Wireshark · Ethereal-users: Re: [Ethereal-users] Dropped packets while Capturing to a File - How can I tell??

[Ulf Lamping <ulf.lamping@xxxxxx>]

Feeny, Michael (TD&DS, Applications Infrastructure Svcs.) wrote:

> Hi,
>
> I am capturing with Ethereal (0.10.13) on a virtual Windows 2000 
> server, which is running atop VMWare, and Ethereal is experiencing 
> packet drops. This is based on seeing “Drops: 522” at the bottom of 
> capture screen, and from numerous “Previous Segment Lost” warnings 
> within the packet list.
>
> After reading the Ethereal Performance Wiki, I will try increasing the 
> buffer size (it’s only 1MB now), and I’m hoping this will improve 
> things. But my question involves recognizing packet drops in a capture 
> file.
>
> I almost always capture to files, and then analyze the files later. 
> Had I not seen the “Drops: 522” at the bottom of the screen, I would 
> not have realized packets were getting dropped. Is there any way, when 
> looking at a capture file created by Ethereal, to know if packets were 
> dropped? From the “Drops: 522” message, it seems that Ethereal 
> recognizes drops when they occur. Does Ethereal indicate drops in the 
> capture file??? (I looked, but I did not find such an indication.)
No, Ethereal don't indicate packet drops any further as the libpcap file 
format doesn't keep this information.

Regards, ULFL