Re: [Ethereal-users] About Dropped Packets

[Guy Harris <gharris@xxxxxxxxx>]

On Mon, Sep 09, 2002 at 08:00:20PM -0300, Sandra wrote:
> I´m working with Ethereal and I´d like to ask you some questions.
> 
>   a.. What means "Dropped Packets" in the Summary in Tools?

It reports the number number of packets dropped during a capture, as
reported to Ethereal by the libpcap/WinPcap library when it does the
capture.  If you are reading a saved capture file, that information
isn't available.

Whether the libpcap/WinPcap library (which is what Ethereal uses to do
packet captures) reports meaningful information about dropped packets
depends on the OS on which you're running, and possibly also on the
version of libpcap you're using and the version of the OS on which
you're running.

On those OSes where that information is available, it indicates
(approximately) the number of packets that the machine's network
interface captured but that couldn't be supplied to Ethereal because the
packets arrived too quickly for Ethereal to process them so that some
packets got discarded by the OS.

>   b..  How does ethereal detect collision?

Ethereal *doesn't* detect collisions.  The network hardware detects
collisions.

>         Are these packets captured ?

No.  If a collision occurs, Ethernet interfaces normally just discard the
packet (if the collision was detected when receiving the packet) or back
off and attempt to transmit the packet a few more times (if the
collision was detected when transmitting the packet).