This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

packet misses at high incoming packet rates

0

Hi,

I am testing our own Ethernet Controller board. We have support for RGMII 1000Mbps and I am generating Etherent packets at a high rate of 850Mbps.

The set-up I use to test is the following. I have my board connected to Windows PC running Wireshark. It is a direct link through an Ethernet cable, with no switch/router in between.

Our board generates Etherent packets at the high rate of 850Mbps, however, at the Wrireshark end, I see that all the packets are not received. When I send around 100 packets at 850Mbps - all packets are received at Wireshrk and displayed in the Wireshark window. However, if I send around 10,000 packets at 850Mbps - only around 8000 packets are received and displayed by Wireshark.

Is there any known restriction for Wireshrk at this high rate of packets? Has anybody faced similar issues?

I have tested transmission-reception between two of our boards, and all the packets are received. Hence this rules out any issues related to our boards.

Regards, Vineetha

asked 02 Mar '16, 22:29

Vineetha's gravatar image

Vineetha
6112
accept rate: 0%


One Answer:

0

The issue isn't just with Wireshark, it's the capture mechanism (probably WinPcap as you're running Windows) and the I/O capabilities of your PC (disk, memory, NIC).

Wireshark does dissection as well as capture (and updates a GUI as well), so isn't the best choice for high speed captures, dumpcap, part of the Wireshark suite, is the actual capturing process so using that may help.

Even if you use dumpcap, I don't think standard commodity PC hardware and software can reliably capture at those rates. To do that you're probably looking at specialised capture hardware, e.g SteelCentral Netshark.

answered 03 Mar '16, 00:19

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%