Wireshark-users: Re: [Wireshark-users] Tshark shows packet loss while tcpdump doesn't! - Why?

From: H Aslam <hassan-aslam@xxxxxxxxxxx>
Date: Wed, 2 Sep 2009 22:02:00 +0200

> Because TShark does more work on the packets if you're asking it to > dissect every single packet (which is what it does in that case - it > has to do that in order to calculate RTP statistics) than tcpdump does > if you have it just write the packets out to a file. While running "top" on the linux machine 50% of the processor is occupied. So the processor doesn't seem to get overloaded. Is the problems buffers in Linux? If so which do you think are overflowed?   > Try > > tshark -i 6 -c 5000 -d udp.port==1234,rtp -z rtp,streams udp port 1234 > > which *does* have a (capture) filter, "udp port 1234". No guarantees > that all the per-packet work done by TShark can be done quickly enough > not to drop packets. This doesn't help... check out the rest of the Windows Live™. More than mail–Windows Live™ goes way beyond your inbox. More than messages