ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] Capturing RTP data

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 11 Apr 2008 10:49:41 -0400


Goran �trok wrote:

I want to know if is possible that I get lost data because of capture. If for example in wireshark I see first packet with sexuence number 1, second with 3, third with 4 and so on. Is possible that second packet (with seq num 2) is lost because third packet (seq num 3) comes and is captured before the second? Is here any buffer (if yes, how long?) to wait for right packet with right seq number.
I capture with dumpcap with flags -w, -c and -i with no dropped packet.

The capture mechanism just takes whatever packets it can get, it does not look at sequence numbers before accepting the packets.

That being said, of course there are buffers that could fill up if you're capturing a lot of traffic but that has nothing to do with the sequence numbering (if any) in the packets.