Wireshark-dev: Re: [Wireshark-dev] jumping tcp packets
From: "Maria de Fatima Requena" <[email protected]>
Date: Thu, 3 Apr 2008 11:12:39 +0200
And so, any posible solution?. 

(Thank you so much for such a quick response)


María de Fátima Requena Cabot (2488)
+34 91 787 23 00 alhambra-eidos.es
 


-----Mensaje original-----
De: [email protected] [mailto:[email protected]] En nombre de ronnie sahlberg
Enviado el: jueves, 03 de abril de 2008 10:53
Para: Developer support list for Wireshark
Asunto: Re: [Wireshark-dev] jumping tcp packets

You would only be able to see the packets that you are fast enough to
capture, process and write to disk.
In particular for high speed networks it is an unfortunate
fact-of-life that you wont be able to capture packets and write them
to disk at the same speed as the packets arrive at the nic  and thus
you get missed packets unless you have a high-end disk subsystem.

What is the line speed and throughput you are looking at?


On Thu, Apr 3, 2008 at 7:35 PM, Maria de Fatima Requena
<[email protected]> wrote:
> Hi
>
>  I am implementing a skinny sniffer using winpcap and I am experimenting problems while parsing packets. Some of them are just missed to my application. I am using wireshark to see what is really happening, and I cant understand it
>
>  This is part of my code (callback function called by winpcap):
>
>
>  void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
>  {
>         ip_header *ih=NULL;
>         udp_header *uh=NULL;
>         tcp_header *th=NULL;
>         u_int ip_len;
>         u_short tcp_len;
>         char* sipP,*sipBody;
>         char* skinnyP;
>         std::string payload;
>     int longSIP;
>         map<string,callId_st*>::iterator it;
>
>         Logger* mainLog=0;
>
>
>         /* retireve the position of the ip header */
>         ih = (ip_header *) (pkt_data +
>                 14); //length of ethernet header
>
>         /* retrieve the position of the udp header */
>         ip_len = (ih->ver_ihl & 0xf) * 4;
>
>         mainLog=Logger::GetLogger("main");
>
>         if (ih->proto==0x06)//tcp == 0x06
>         {
>                 th = (tcp_header *) ((u_char*)ih + ip_len);
>
>                 u_short sport=ntohs(th->sdPorts.sport);
>                 u_short dport=ntohs(th->sdPorts.dport);
>
>                 if (sport==2000||dport==2000)//0x7d0=2000
>                 {
>  ...
>
>  This function is run inside a thread as:
>
>  pcap_loop((pcap_t *)handle,0, packet_handler, NULL);
>
>  With this instruction: if (ih->proto==0x06)//tcp == 0x06 I would be able to see every TCP incoming packet anyway, many packets wireshark is able to capture, are left for me. Can anyone have an idea of what is happening?
>
>  Thanks in advance
>
>
>
>
>  María de Fátima Requena Cabot (2488)
>  +34 91 787 23 00 alhambra-eidos.es
>
>
>  _______________________________________________
>  Wireshark-dev mailing list
>  [email protected]
>  http://www.wireshark.org/mailman/listinfo/wireshark-dev
>
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev