I am attempting to use Wireshark on a laptop using the built-in NIC. The throughput of the traffic being captured is very high and sustained, and it appears I may be dropping traffic (observing "acknowledgement for unseen packet" errors). I feel the laptop NIC may be inadequate. Purchasing a probe or server with industrial NIC's is a bit overkill, as I only need this for a few days. Would a separate USB NIC provide the ability to capture higher throughput using the same laptop? asked 08 Jun '11, 14:17  Husker97 retagged 08 Jun '11, 19:41  helloworld |
One Answer:
I don't see how a separate USB NIC would help you. For performance problems like dropped packets, you might try reading the Performance page on the Wireshark wiki. But I would highly recommend using dumpcap instead of Wireshark for capturing if you're dropping too many packets. Besides helping with performance, another benefit of using dumpcap instead of Wireshark is that it will avoid/eliminate any potential "out of memory" problems you could otherwise encounter by using Wireshark, especially if you intend to capture for lengthy periods of time. You could also try using Windump or tcpdump depending on what OS your laptop is running. answered 08 Jun '11, 16:23  cmaynard ♦♦ |
