This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Using Wireshark In A High Speed Environment

0

I am trying to measure a high speed telemetry system. It is capable of producing > 1000 frames per second or 1000Hz. I am using wireshark to capture the UDP port where these frames are produced. I have had much trouble getting a reliable measurement. I was wondering if your team has tested wireshark at these rates before? If so, can you tell me what rate wireshark can reliably measure?

asked 29 Feb '12, 06:58

ggray08's gravatar image

ggray08
1●1●1●1
accept rate: 0%

What are you trying to "reliably measure" ?

Also: Assuming full size frames: 1000 frames/sec * 1500 bytes/frame ==> 12 Mbits/sec doesn't seem to me to be be excessively high.

(29 Feb '12, 16:57) Bill Meier ♦♦

This is a 10017 Byte UDP frame @ 1000 Hz (80 Mbits/sec). My system is capable of doubling that number also. I was just wondering if Wireshark can actually keep up and capture each frame at these speeds.

(01 Mar '12, 08:29) ggray08

One Answer:

0

OK:

  1. Do some web searches using terms like: 'wireshark "high-speed" capture loss' to find some discussions.

  2. At the very least do capturing separately from analysis. That is: if you are using Wireshark (or tshark) try using dumpcap (or tcpdump ? or ?? ) to do the capture. Wireshark can then be used to analyze the resulting file.

dumpcap is the program which actually does the capturing. Wireshark uses dumpcap to do the capturing but is also doing dissection as the capture takes place.

  1. Other thoughts: Do you need the complete contents of each frame ? ISTR that restricting the "snapshot length" (maximum amount of data actually captured from each frame) may help. If nothing else there will be less data to write to disk.

  2. Obviously YMMV depending upon the hardware, OS, capture program, etc, etc being used and thus, in general, it's difficult if not impossible to provide a simple answer to your question.

answered 01 Mar '12, 10:02

Bill%20Meier's gravatar image

Bill Meier ♦♦
3.2k●1●8●50
accept rate: 17%

Thank you! I will try your comments. Appreciate your time.

(02 Mar '12, 06:28) ggray08