Wireshark · Wireshark-users: Re: [Wireshark-users] Wireshark for Beacon Sniffing

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jan 21, 2009, at 4:47 PM, Johne Cookcely wrote:

> Hi! OmniPeek was on Windows xpsp2, Wireshark is on Linux ubuntu8.04.

"Same location, same channel, same card" doesn't necessarily imply  
"same experience", as there's a bunch of software in the way.

In particular, the capture code path for Wireshark-on-Linux might drop  
more packets than the capture code path for OmniPeek-on-Windows.

When you stop the capture, the status bar (if it's displayed) should  
show

	Packets: {N} Displayed: {N} Marked: 0 Dropped: {M}

for some values of N and M.  If M isn't zero, some packets were  
dropped because the capture code path wasn't fast enough to capture  
them and save them to disk; 293149 beacons/hour is about 81 beacons/ 
second, so I could imagine packets getting dropped.  How many are  
getting dropped?

(Ubuntu 8.04 should have a recent enough libpcap that it will report  
how many packets were dropped by the Linux capture mechanism because  
they weren't getting processed fast enough, so Wireshark should be  
able to report a count of dropped packets.)