This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

I'm trying to capture packets from my embedded board (IP 192.168.66.190, port 1025) using UDP. It's working fine in Windows XP, but it doesn't work in Windows 7. Wireshark is still able to detect the packets coming in, but there is nothing when a UDP listener is started on the same port.

asked 10 Apr '13, 03:31

ktchiam's gravatar image

ktchiam
11112
accept rate: 0%


That's a Windows question really, since Wireshark is able to capture them.

permanent link

answered 10 Apr '13, 03:54

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

Try turning the Windows Firewall off. If that fixes the issue and you want the firewall back on (as you should do generally) then you'll need to add an exception to the firewall for your app to allow the UDP traffic in.

permanent link

answered 10 Apr '13, 04:19

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Sorry that it's kind of Windows related, but since Wireshark can capture the packets, may be someone would know why.

I've turned off the firewall, but it still doesn't work. I've also opened up another client to send UDP packets to 1025 and it can be received. It just won't receive packets coming from my ethernet port.

(10 Apr '13, 04:23) ktchiam

Wireshark, or to be technically accurate WinPCap, captures traffic in a very different manner than a normal app would receive it.

When you say you've opened up another client to send UDP packets and they are received, was that client on the same host as the listener app, or another host?

Does your app bind it's listener to the required IP address or does it listen on all?

(10 Apr '13, 04:40) grahamb ♦

Sorry that it's kind of Windows related, but since Wireshark can capture the packets, may be someone would know why.

Probably because the packets are somehow 'damaged' and windows drops them. Take a look at the IP stats of windows. Do the counters for 'errors' increase while you are seeing the packets in Wireshark, but not in your application?

netstat -s

IPv4 Statistics

  Packets Received                   = 1070088
  Received Header Errors             = 0
  Received Address Errors            = 271
  Datagrams Forwarded                = 0
  Unknown Protocols Received         = 0
  Received Packets Discarded         = 67898
  Received Packets Delivered         = 1108133
  Output Requests                    = 1979878
  Routing Discards                   = 0
  Discarded Output Packets           = 5809
  Output Packet No Route             = 1
  Reassembly Required                = 0
  Reassembly Successful              = 0
  Reassembly Failures                = 0
  Datagrams Successfully Fragmented  = 0
  Datagrams Failing Fragmentation    = 0
  Fragments Created                  = 0

UDP Statistics for IPv4

  Datagrams Received    = 40722
  No Ports              = 352
  Receive Errors        = 67544
  Datagrams Sent        = 61341

Regards
Kurt

permanent link

answered 10 Apr '13, 06:06

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 10 Apr '13, 06:08

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×254
×166
×69
×6
×1

question asked: 10 Apr '13, 03:31

question was seen: 4,418 times

last updated: 10 Apr '13, 06:08

p​o​w​e​r​e​d by O​S​Q​A