This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Packet Capture Application performances

0

Dear All, I'm developing a WIndows7 application that get UDP packets from the network interface card. The application needs the amount of droped packets to be low. I'm experiencing this funny issue: when the application runs alone on the system I experience a UDP packet loss, the same application runs without losing any single UDP packet when Wireshark is capturing data on the same NIC. Now I wonder if (it must be) wireshark applies some setting to the NIC or to the OS to improve its packet capture efficiency. If yes, I would appreciate very much if anybody of you could help me in finding this magic setting and replicate it in my application. Thanks alot in advance for your help. MM

This question is marked "community wiki".

asked 08 Aug '14, 05:30

MMM's gravatar image

MMM
11335
accept rate: 0%


2 Answers:

2

Wireshark puts the NIC in promiscuous mode, which means that it also accepts packets that are not targeted at the MAC address of the NIC. If your application runs better with promiscuous mode you should check the layer 2 addresses of the UDP packets. Maybe some of them are addressed at a different/wrong MAC address?

Promiscuous mode should not be used by any normal application, it is only leveraged for packet captures.

answered 08 Aug '14, 05:59

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Hi, thank a lot for your help. Jasper, you got it. From time to time the ethernet destination address of the UDP packet is wrong at the source. Wireshark is Great!! Thanks you everybody. MMM

(14 Aug '14, 10:15) MMM

0

answered 10 Aug '14, 07:14

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%