This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

We use wireshark for analyzing packet captures we collect with tcpdump and/or tshark on Linux systems. I have been trying to understand the impact of running tcpdump/tshark on packet flow of the host system, but I cannot seem to find much information on this. Can anyone explain how these tools interact with the host system and the impact on network activity?

Is any latency introduced into the session or risk of packets being dropped by the kernel due to the additional demands of copying incoming network data for the capture?

Thanks, Ryan

asked 25 Sep '14, 06:45

ryber's gravatar image

ryber
146459
accept rate: 16%


I don't have any numbers for you but for sure adding network capture adds work to the host. Some places where this would be the case:

  1. If running a capture turns on promiscuous mode then you'll be getting more traffic than usual (in modern switched networks there normally won't be much more). If you for some reason do end up getting a lot more traffic then this could affect latency and/or cause more packets to be dropped.
  2. A monitored packet needs to be copied to 2 applications: the real network application and tcpdump/dumpshark. If you're on a RISC machine like SPARC such an extra copy can be quite expensive; on x86 it's much less of a problem. Unless your CPU usage is quite high this is unlikely to cause significant additional latency or packet drops.

Of course all of the effects become bigger as traffic rates go up. So: if your traffic rate is not huge and/or your application is not super-critical, sure you can probably safely capture the traffic. Otherwise you might want to invest in a dedicated capture system (attached to a monitor port).

permanent link

answered 20 Oct '14, 05:40

JeffMorriss's gravatar image

JeffMorriss ♦
6.2k572
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×97
×61
×55
×1

question asked: 25 Sep '14, 06:45

question was seen: 7,476 times

last updated: 20 Oct '14, 05:40

p​o​w​e​r​e​d by O​S​Q​A