This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Does Wireshark capture/support RSC packets

0

Hi, Windows 8 Server and certain network adapters will be supporting Receive Side Coalescing (or Receive Segment Coalescing if you're Intel). Does Wireshark support the capturing of Coalesced packets? Will Wireshark have any restrictions on the packet size?

Thank you!

asked 16 Feb '12, 11:01

eastilleros's gravatar image

eastilleros
1111
accept rate: 0%


2 Answers:

1
  • Does Wireshark support the capturing of Coalesced packets?

This seems to be done in the NIC, or low level driver. It's most likely WinPcap will see the packets after that, which should be indistinguishable from normal packets.

  • Will Wireshark have any restrictions on the packet size?

WinPcap captures into the pcap format which has a max record size of 64kB. That would pose a limit.

answered 16 Feb '12, 23:51

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

1

"Indistinguishable" other than perhaps being much larger than the largest link-layer frame size on the network type on which you're capturing; for example, you might have Ethernet packet larger than 1514 bytes (without FCS)/1518 bytes (including FCS).

Actually, pcap itself doesn't have a maximum record size of 64KB, but Wireshark currently imposes that limit (so it doesn't try to do ridiculously-large memory allocation with a corrupted capture); that limit could be raised, although we'll probably never raise it to, say, 2^32-1.

(17 Feb '12, 00:01) Guy Harris ♦♦

0

In windows the RSC getting disabled after i start wireshark

RSC table before starting wireshark

PS C:\Users\Administrator> get-netadapterrsc

Name IPv4Enabled IPv6Enabled IPv4Operational IPv6Operational IPv4FailureReason IPv6Failure State State Reason ---- ----------- ----------- --------------- --------------- ----------------- ------------ Ethernet 4 True True True True NoFailure NoFailure Ethernet 3 True True True True NoFailure NoFailure

RSC table after starting wireshark.

PS C:\Users\Administrator> get-netadapterrsc|format-table -wrap -autosize

Name IPv4Enabled IPv6Enabled IPv4OperationalState IPv6OperationalState IPv4FailureReason IPv6FailureReason ---- ----------- ----------- -------------------- -------------------- ----------------- ----------------- Ethernet 4 True True False False NDISCompatibility NDISCompatibility Ethernet 3 True True False False NDISCompatibility NDISCompatibility

The above output is complaining about the NDIS for compatibility.

answered 04 Sep '14, 05:39

Naveen1115's gravatar image

Naveen1115
11113
accept rate: 0%

edited 04 Sep '14, 10:04

grahamb's gravatar image

grahamb ♦
19.8k330206