[Winpcap-users] Strange timestamp distribution while, sniffingPPP-connections (RAS via netmonitor)

[Mark Bednarczyk]

Packets are buffered before sending out any network interface. This allows
packets to be transmitted even if the output interface is busy sending
packets before it. If the buffer is completely filled, then new packets are
dropped. It doesn't sound like this is what's happing in your case. Just a
little bit of latency while packets are being transmitted over a slower
medium aka. your PPP interface.

On unix you would use "netstat -i"  to debug something like this, on windows
netstat -e is the closest I can think of.

Cheers,
mark...



> -----Original Message-----
> From: winpcap-users-bounces at winpcap.org 
> [mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Marc Wetzel
> Sent: Tuesday, August 14, 2007 8:04 AM
> To: winpcap-users at winpcap.org
> Subject: RE: [Winpcap-users] Strange timestamp distribution 
> while, sniffingPPP-connections (RAS via netmonitor)
> 
> Hi Mark,
> 
> Hmm - shouldn't I see some "more" packets in my tcplog if 
> this is happening, or what do you mean by "filling the output-queue" ?
> 
> BR
> Marc
> 
> > Looks like a bandwidth contention on your PPP link. When 
> you start up 
> > the your "dashboard" app it might be generating traffic and 
> filling up 
> > the system's output queues on the PPP interface.
> >
> > Just a thought,
> > Cheers,
> > mark...
> >   
> 
> _______________________________________________
> Winpcap-users mailing list
> Winpcap-users at winpcap.org
> https://www.winpcap.org/mailman/listinfo/winpcap-users