Re: Packets not captured, tcp acking lost segments. Large packets

[Sake Blok <sake () euronet nl>]

On 8 jan 2011, at 11:40, Michael Lynch wrote:

> God I hope IPv6 is simpler!!

In some ways it is, but in most ways it isn't, you're in for a treat :-)

> Laura mentions that her Wireshark did pick up these LSO packets in the trace, so I guess I was just unlucky.
> As Graham suggested, I will give a try the "Edit | Preferences | Expand Protocols and find IP | Check "Support 
> packet-capture from IP TSO-enabled hardware".
> I'll let you know if that options resolves the incomplete capture trace.

It won't, the protocol options only have effect on the way Wireshark interprets and displays the captured data not on 
which packets will be captured.

If the large frames were not captured, they were not captured. It is however interesting to see that netmon on the same 
machine was able to capture them, while wireshark wasn't. This can be caused by the fact that they both use a different 
way of getting the packets of the networking stack. Since Wireshark uses WinPcap on windows systems, that's where this 
could be solved. You might want to address this at the WinPcap mailinglist to improve the WinPcap library to be able to 
capture large frames in your particular setup (which must also be used by other people).

Cheers,


Sake


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe