Wireshark-users: Re: [Wireshark-users] packets lost at 480Mbps
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 16 Mar 2009 13:36:57 -0700

On Mar 13, 2009, at 8:52 PM, jli@xxxxxxxxxxxx wrote:


Hi:
I am running wireshark-win32-1.1.2 on WinXP sp3 to capture packets with changeless number, but found packets lost when "drop" is zero, and the number of lost packets is just the same as number added in "Interface -> details -> statistics-> Receive but no buffer". Does "Receive but no buffer " means MAC buffer is full so MAC discard packets, or wireshark reading and saving speed is too slow so wireshark discard same packets? 
     Anyone will help me?
See the responses you got on the WinPcap mailing list. The problem appears to be "MAC buffer is full so MAC discard packets", i.e. the buffer being overrun is the ring buffer your NIC has for incoming packets, not any buffer inside WinPcap that's not being emptied fast enough for Wireshark.