Wireshark-users: Re: [Wireshark-users] Tshark shows packet loss while tcpdump doesn't! - Why?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: H Aslam <hassan-aslam@xxxxxxxxxxx>
Date: Wed, 2 Sep 2009 22:02:00 +0200
> Because TShark does more work on the packets if you're asking it to
> dissect every single packet (which is what it does in that case - it
> has to do that in order to calculate RTP statistics) than tcpdump does
> if you have it just write the packets out to a file.

While running "top" on the linux machine 50% of the processor is occupied. So the processor doesn't seem to get overloaded.

Is the problems buffers in Linux? If so which do you think are overflowed?
 
> Try
>
> tshark -i 6 -c 5000 -d udp.port==1234,rtp -z rtp,streams udp port 1234
>
> which *does* have a (capture) filter, "udp port 1234". No guarantees
> that all the per-packet work done by TShark can be done quickly enough
> not to drop packets.

This doesn't help...

check out the rest of the Windows Live™. More than mail–Windows Live™ goes way beyond your inbox. More than messages