Thanks Jeff for the explanation. I think it's because the CPU load
was saturated temporarily while tshark was running. Once I disabled
all the running programs there are no more drop packets.
On Thu, Jan 7, 2010 at 9:52 AM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:
> David wrote:
>> When I run tshark sometime I get "xxxx packets dropped" at the end of
>> the session. Does this mean the wireshark is dropping the packets
>> or the capture NIC is overrun or something else?
>
> It means the NIC received the packets but the capturing mechanism
> (libpcap + Wireshark) couldn't keep up.
>
> You might want to try capturing with 'dumpcap' instead to see if it can
> keep up with your traffic rate.
> ___________________________________________________________________________
> Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives: http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>
