Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Help! errors in CAPTURED UDP stream that I know is perfect

From: Marco Zuppone <msz@xxxxxx>
Date: Sun, 13 Nov 2011 12:54:03 +0000
Hello,

I never experienced this issue but I have some suggestion for you:

1-Use Wireshark 1.6.3
2-If you are concerned that Wireshark is not able to capture packets properly (maybe due to performance issues) use the command line tools that come with it instead of the graphical interface.
I'm referring to tshark or dumpcap.
3-if not really needed avoid to capture in promiscuous mode.
4-Other suggestions are available here: http://wiki.wireshark.org/Performance

 Regards,
Marco - StockTrader

On 8 Nov 2011, at 06:08, Roni Peleg wrote:

Hi Wiresharkers,
 
I’m a newbie so please pardon me if I describe my problem clumsily.
 
Attached is a picture of the way I capture a file.
 
I do the next:
 
1. I inject a perfectly clean MPEG stream over UDP  into a PC with Ethernet 1Gigabit interface network card.
   (I know it’s clean for sure, and anyway I also checked by some reliable testing tools such as StreamXpert running on the same PC, connected to the same interface port)
2. I close all windows, no program is running on the PC. The UDP stream continues flowing in all the time.
3. I open Wireshark, set a capture-file and start recording (I tried with and without filtering only the relevant IP).
4. From the resulting capture-file I’m striping the MPEG stream out of the UDP encapsulation. (did this a hundred times, it’s 100% reliable)
5. in the resulting MPEG stream I get “Continuity-Counter Errors” which means packets were lost or mixed with another stream.
6. Actually, instead of steps 4-5 I later on simply ran Wireshark’s MPEG-TS-checker and indeed the Wireshark itself reported the same  CC Errors!
 
Have you ever encountered such a problem?
Could it be that Wireshark is too weak to record a ~50Mbps stream into a capture file?
What should I do??
 
 
Thanks in advance,
Roni
 
<wirepic1.bmp><wirepic2.bmp>___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe