This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, Windows 8 Server and certain network adapters will be supporting Receive Side Coalescing (or Receive Segment Coalescing if you're Intel). Does Wireshark support the capturing of Coalesced packets? Will Wireshark have any restrictions on the packet size?

Thank you!

asked 16 Feb '12, 11:01

eastilleros's gravatar image

eastilleros
1111
accept rate: 0%


  • Does Wireshark support the capturing of Coalesced packets?

This seems to be done in the NIC, or low level driver. It's most likely WinPcap will see the packets after that, which should be indistinguishable from normal packets.

  • Will Wireshark have any restrictions on the packet size?

WinPcap captures into the pcap format which has a max record size of 64kB. That would pose a limit.

permanent link

answered 16 Feb '12, 23:51

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

1

"Indistinguishable" other than perhaps being much larger than the largest link-layer frame size on the network type on which you're capturing; for example, you might have Ethernet packet larger than 1514 bytes (without FCS)/1518 bytes (including FCS).

Actually, pcap itself doesn't have a maximum record size of 64KB, but Wireshark currently imposes that limit (so it doesn't try to do ridiculously-large memory allocation with a corrupted capture); that limit could be raised, although we'll probably never raise it to, say, 2^32-1.

(17 Feb '12, 00:01) Guy Harris ♦♦

In windows the RSC getting disabled after i start wireshark

RSC table before starting wireshark

PS C:\Users\Administrator> get-netadapterrsc

Name IPv4Enabled IPv6Enabled IPv4Operational IPv6Operational IPv4FailureReason IPv6Failure State State Reason ---- ----------- ----------- --------------- --------------- ----------------- ------------ Ethernet 4 True True True True NoFailure NoFailure Ethernet 3 True True True True NoFailure NoFailure

RSC table after starting wireshark.

PS C:\Users\Administrator> get-netadapterrsc|format-table -wrap -autosize

Name IPv4Enabled IPv6Enabled IPv4OperationalState IPv6OperationalState IPv4FailureReason IPv6FailureReason ---- ----------- ----------- -------------------- -------------------- ----------------- ----------------- Ethernet 4 True True False False NDISCompatibility NDISCompatibility Ethernet 3 True True False False NDISCompatibility NDISCompatibility

The above output is complaining about the NDIS for compatibility.

permanent link

answered 04 Sep '14, 05:39

Naveen1115's gravatar image

Naveen1115
11113
accept rate: 0%

edited 04 Sep '14, 10:04

grahamb's gravatar image

grahamb ♦
19.8k330206

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×13
×2
×1

question asked: 16 Feb '12, 11:01

question was seen: 3,301 times

last updated: 04 Sep '14, 10:04

p​o​w​e​r​e​d by O​S​Q​A