libpcap icon indicating copy to clipboard operation
libpcap copied to clipboard

Published 20 hours ago • verified publisher icon the-tcpdump-group

Wireshark make our program dropless?

Open guoyaobit opened this issue 2 years ago • 2 comments

Multi-process capture on the same NIC is better than single-process. Even running wireshark on the background ,make the our capture program drop less. Why ?

guoyaobit avatar Mar 27 '23 03:03 guoyaobit

If you still experience the problem, please provide detailed steps to reproduce. Otherwise this request will be closed.

infrastation avatar Jan 30 '24 22:01 infrastation

If you still experience the problem, please provide detailed steps to reproduce. Otherwise this request will be closed.

We apologize for not being able to figure it out at the moment. Perhaps the issue lies in the relationship between multiple NPCAP applications on Windows, especially in extremely high-speed situations.

guoyaobit avatar Jan 31 '24 14:01 guoyaobit

Please reopen after you have a detailed description of the problem.

infrastation avatar Feb 23 '24 14:02 infrastation

Note also that a lot of the packet capture code on any platform is in the underlying capture mechanism that libpcap uses.

On Windows with Npcap, that's the Npcap NPF driver and the packet32.dll library that uses it. (On Linux, that would be the PF_PACKET socket code, and on *BSDs, including ~~CupertinoBSD~~macOS, and in AIX and Solaris, the would be the BPF packet capture mechanism.)

None of those are developed and maintained by us. For Npcap, you might want to file an issue on the Npcap issues list.

guyharris avatar Feb 23 '24 19:02 guyharris