This is our old Q&A Site. Please post any new questions and answers at

hi experts -

I am running a capture with dumpcap and rawshark on a very busy machine. I usually get a report like "Packets: 100847 Packets dropped: 1124898" from dumpcap (when I am killing it after 100,000 packets).

dumpcap process is configured to capture on:

  1. one of 8 interfaces
  2. tcp port 80

(example:/root/monitor/wireshark-1.4.2/.libs/dumpcap -w- -f tcp port 80 -i eth4)

does the "packet dropped" count include packets from :

  1. other interfaces
  2. non tcp / non port 80 ,

or is it just packets dropped to dumpcap not being able to capture fast enough ? is there a general way to check the reason for dropped packets ?

thanks - Yoav.

asked 02 Feb '11, 01:40

yoav's gravatar image

accept rate: 0%

edited 02 Feb '11, 01:44

It means "packets dropped because they came in too fast for dumpcap to save"; the packet capture mechanisms that libpcap/WinPcap use (dumpcap, like tcpdump and many other packet-capture programs, uses libpcap/WinPcap) have a buffer into which packets received from the network are dumped, and if that buffer isn't emptied fast enough by the application, packets that arrive will be discarded. That's what the mechanisms count as dropped packets.

permanent link

answered 02 Feb '11, 18:49

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 02 Feb '11, 01:40

question was seen: 16,378 times

last updated: 02 Feb '11, 18:49

p​o​w​e​r​e​d by O​S​Q​A