Wireshark · Ethereal-users: Re: [Ethereal-users] newbie Help

[Guy Harris <gharris@xxxxxxxxx>]

Ulf Lamping wrote:

> if it *is* zero than it's only
> value is "captured all packets" OR "the hardware simply doesn't detect
> such things"

...OR "the OS's packet capture mechanism drops packets if the 
application isn't reading packets fast enough so that packets arrive 
faster than the application consumes them, and the packet capture 
mechanism's internal buffer fills up, *BUT* that packet capture 
mechanism doesn't count the number of packets dropped if that happens, 
so that libpcap can't report that value to the application".  That's the 
case on some OSes, such as those with older Linux kernels.