Ask Your Question

Revision history [back]

Missed first packets after reconnect

Hi,

I currentlly have an issue using wireshark (4.0-1) on windows (21H2 Build 19044.2130). I have a device that sends some dhcp discover messages once it is powered and a physical connection is established. The send out is done after 1 seconds, 2 seconds and 4 seconds.

Related to the hardware setup, it looks like wireshark (or the OS, driver stack...) needs some time to startup.

Setup 1: Device <-> Switch <-> Host Wireshark running on the host can capture all dhcp packets

Setup 2: Device <-> Host Wireshark can not caputre all packets. The packets send in the first ~4 seconds are not captured. The last dhcp packet is captured most of the time.

I assume that it needs some time for the OS to setup the driver stack and other things after the network card established the physical connection including autonegotiation and thinks like that.

E.g. the windows "Network and Sharing Center" lists the connection also after some delay. In the moment the connection is listed, wireshark captures the first packets.

I know it looks more like an "windows issue". But are there any tipps or tricks how windows or wireshark should be configured to reduce the delay between establishing a connectection and capturing/providing the first packets?