tshark or dumpcap affecting RDP session on Windows Server 2012R2

asked 2020-09-15 19:55:07 +0000

JohnBoy
3 ●1 ●1 ●4

Has anyone encountered RDP performance issues while running tshark or dumpcap on a remote Windows 2012R2 server?

I have found lately that when I run a persistent tshark capture (or dumpcap), using out of band network ports, writing to a file ring buffer, the in-band RDP session that I use to administer the same server suffers from RDP issues to the point where, after some time passes, I need to reboot the server to regain control. All the while, the tshark session runs merrily along.

I hope I explained this well enough.

Today, for the first time, I am trying to run the tshark capture from within a bat file being called from a scheduled task so that I dont have to be logged into the server via RDP. So far, so good. Time will tell.

Thanks in advance.

John

edit retag flag offensive close merge delete

Comments

What does tshark --version report about the version of WinPcap or Npcap with which it's running?

Guy Harris ( 2020-09-15 21:21:53 +0000 )edit

Thanks for your response. Here is the output of that command:

TShark (Wireshark) 3.2.4 (v3.2.4-0-g893b5a5e1e3e)

Copyright 1998-2020 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later <https://www.gnu.org/licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with WinPcap SDK (WpdPack) 4.1.2, with GLib 2.52.3, with zlib
1.2.11, with SMI 0.4.8, with c-ares 1.15.0, with Lua 5.2.4, with GnuTLS 3.6.3
and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB
resolver, with nghttp2 1.39.2, with brotli, with LZ4, with Zstandard, with
Snappy, with libxml2 2.9.9.

Running on 64-bit Windows Server 2012 R2, build 9600 ...

(more)

JohnBoy ( 2020-09-16 11:53:07 +0000 )edit

Npcap version 0.9991

npcap is currently at 0.9997 with fixes for memory use.

Example here of upgrade helping.

Chuckc ( 2020-09-16 14:18:17 +0000 )edit

Also note that 3.2.6 is the current stable release.

grahamb ( 2020-09-16 14:34:57 +0000 )edit

Thanks guys... I'll give the new version a go and see how I make out.

Cheers.

JohnBoy ( 2020-09-16 14:37:42 +0000 )edit

see more comments

tshark or dumpcap affecting RDP session on Windows Server 2012R2

Comments

1 Answer

Your Answer

Question Tools

Stats

Related questions

tshark or dumpcap affecting RDP session on Windows Server 2012R2 edit

Comments

1 Answer

Your Answer

Question Tools

Stats

Related questions

tshark or dumpcap affecting RDP session on Windows Server 2012R2