Skip to content
GitLab
  • Menu
Projects Groups Snippets
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
    • Switch to GitLab Next
  • Sign in / Register
  • wireshark wireshark
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributors
    • Graph
    • Compare
    • Locked Files
  • Issues 1,341
    • Issues 1,341
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • Merge requests 153
    • Merge requests 153
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Schedules
    • Test Cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Code review
    • Insights
    • Issue
    • Repository
  • Wiki
    • Wiki
  • External wiki
    • External wiki
  • Snippets
    • Snippets
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • Wireshark Foundation
  • wiresharkwireshark
  • Issues
  • #17089
Closed
Open
Created Dec 16, 2020 by Chuck Craft@chuckcraftContributor

Dumpcap with threads reports double received count vs captured

Summary

The received packet count is double the packets captured when threads are used.

Steps to reproduce

Capture with -t option or capture on multiple interfaces which uses threads.

-t use a separate thread per interface

What is the current bug behavior?

C:\Development\wsbuild64\run\RelWithDebInfo>dumpcap -D
1. \Device\NPF_{} (Local Area Connection* 8)
2. \Device\NPF_{} (Local Area Connection* 6)
3. \Device\NPF_{} (Local Area Connection* 7)
4. \Device\NPF_{} (Ethernet0)
5. \Device\NPF_Loopback (Adapter for loopback traffic capture)

C:\Development\wsbuild64\run\RelWithDebInfo>dumpcap -i 5
Capturing on 'Adapter for loopback traffic capture'
File: C:\Users\IEUser\AppData\Local\Temp\wireshark_Adapter for loopback traffic captureOWTWV0.pcapng
Packets captured: 12
Packets received/dropped on interface 'Adapter for loopback traffic capture': 12/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (100.0%)

C:\Development\wsbuild64\run\RelWithDebInfo>dumpcap -i 5 -t  (**use_threads**)
Capturing on 'Adapter for loopback traffic capture'
File: C:\Users\IEUser\AppData\Local\Temp\wireshark_Adapter for loopback traffic captureL3NUV0.pcapng
Packets captured: 8
Packets received/dropped on interface 'Adapter for loopback traffic capture': 16/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (100.0%)

C:\Development\wsbuild64\run\RelWithDebInfo>dumpcap -i 1 -i 2 -i 3 -i 4 -i 5  (**use_threads**)
Capturing on 5 interfaces
File: C:\Users\IEUser\AppData\Local\Temp\wireshark_5_interfacesJLCJV0.pcapng
Packets captured: 122
Packets received/dropped on interface 'Local Area Connection* 8': 0/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (0.0%)
Packets received/dropped on interface 'Local Area Connection* 6': 0/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (0.0%)
Packets received/dropped on interface 'Local Area Connection* 7': 0/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (0.0%)
Packets received/dropped on interface 'Ethernet0': 243/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (100.0%)
Packets received/dropped on interface 'Adapter for loopback traffic capture': 0/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (0.0%)

C:\Development\wsbuild64\run\RelWithDebInfo>dumpcap -i 4
Capturing on 'Ethernet0'
File: C:\Users\IEUser\AppData\Local\Temp\wireshark_Ethernet0M4QGV0.pcapng
Packets captured: 97
Packets received/dropped on interface 'Ethernet0': 97/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (100.0%)

What is the expected correct behavior?

(What you should see instead)

Sample capture file

(If possible attach a sample capture file, not screenshot of dissection, showing this issue)

Relevant logs and/or screenshots

(Paste any relevant logs here)

(Paste any relevant screenshots here)

Build information

Note: same results with Dumpcap (Wireshark) 3.4.1 (v3.4.1-0-g1a27f405)

C:\Development\wsbuild64\run\RelWithDebInfo>dumpcap -v
Dumpcap (Wireshark) 3.5.0-CDC_201118 (v3.5.0rc0-345-g9fb03566c25e)

Copyright 1998-2020 Gerald Combs <gerald@wireshark.org> and contributors.
License GPLv2+: GNU GPL version 2 or later <https://www.gnu.org/licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.52.3, with zlib 1.2.11, with libpcap.

Running on 64-bit Windows 10 (1809), build 17763, with Intel(R) Xeon(R) CPU
     E5645  @ 2.40GHz (with SSE4.2), with 8191 MB of physical memory, with
locale C, with Npcap version 1.10, based on libpcap version 1.9.1, binary
plugins supported (0 loaded).

Built using Microsoft Visual Studio 2019 (VC++ 14.28, build 29333).

C:\Development\wsbuild64\run\RelWithDebInfo>
Edited Nov 15, 2021 by Gerald Combs
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking