Hi, Windows 8 Server and certain network adapters will be supporting Receive Side Coalescing (or Receive Segment Coalescing if you're Intel). Does Wireshark support the capturing of Coalesced packets? Will Wireshark have any restrictions on the packet size? Thank you! asked 16 Feb '12, 11:01  eastilleros |
2 Answers:
This seems to be done in the NIC, or low level driver. It's most likely WinPcap will see the packets after that, which should be indistinguishable from normal packets.
WinPcap captures into the pcap format which has a max record size of 64kB. That would pose a limit. answered 16 Feb '12, 23:51  Jaap ♦ |
In windows the RSC getting disabled after i start wireshark RSC table before starting wireshark
RSC table after starting wireshark.
The above output is complaining about the NDIS for compatibility. answered 04 Sep '14, 05:39  Naveen1115 edited 04 Sep '14, 10:04  grahamb ♦ |
"Indistinguishable" other than perhaps being much larger than the largest link-layer frame size on the network type on which you're capturing; for example, you might have Ethernet packet larger than 1514 bytes (without FCS)/1518 bytes (including FCS).
Actually, pcap itself doesn't have a maximum record size of 64KB, but Wireshark currently imposes that limit (so it doesn't try to do ridiculously-large memory allocation with a corrupted capture); that limit could be raised, although we'll probably never raise it to, say, 2^32-1.