ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Capture->Interface shows incorrect statistics

From: "Fulko Hew" <fulko.hew@xxxxxxxxx>
Date: Thu, 30 Aug 2007 11:34:29 -0400

(on wireshark 0.99.4)

I was looking at the results from the Capture->Interface statistics display

and the information I get from _my_ embedded system, and I thought
I had an error, but I don't think I do...

In ./gtk/capture_if_dlg.c: update_if() the comments talks about the differences
between wpcap and regular pcap, where wpcap only sends delta statistics
and pcap sends stats since the beginning of the session.

Since I'm using/doing regular-pcap, I send stats accumulated since
the start of the session on each stats request.

The
Capture->Interface statistics display however shows two
pieces of info: packets and packets/sec.  But what I see is that
the packets/sec column is showing the 'total # of packets to date'
and the packets column is adding the other column in on every sample.

I also see the same symptoms when running the stock wireshark (0.99.4)
on Fedora Core 6.

Its as if its using the wpcap algorithm.
But doing a debug trace shows thats not the case.

I say the #ifdef Win32 (at line 247) is backwards and should be #ifndef instead!

Yup!  Just tested that on my Fedora box, and the stats look correct now!