Wireshark-users: [Wireshark-users] Missing bytes in capture file
From: Dale McCoy <dalestan@xxxxxxxxx>
Date: Tue, 30 Aug 2011 11:52:56 -0400
For debugging purposes, I'm trying to capture communications between a
program I'm developing and a recalcitrant IP-based device.

However, in every capture, when looking at the data I'm transmitting
in "Follow TCP stream", I get "[2920 bytes missing in capture file]"
instead of a particularly vital bit of actual capture. It seems to
always be the same packets (by content) that are missing.

The FAQ does not contain anything that looks promising. The two most
common issues seem to be VPN software and wireless interfaces; neither
is present.

The capture filter is set to "host", that being the IP
address of the device that isn't behaving the way I think it should.

What else should I look for/change to get a complete capture?

I'm using Wireshark 1.6.1 and WinPcap 4.1.2 on 32-bit Windows 7 SP1,
and I rebooted after installing.

Dale McCoy