Commissioning
53/90
7.5.3
Displaying lost frames in Wireshark
If the NANL-B500G-RE analyzer device uses very high transfer rates for
data transfer via Ethernet during autonomous operation and the write rate
to the USB memory device increases accordingly, Ethernet frame losses
occur when storing on the USB memory device, i.e. frames are discarded
and no complete capturing of the transferred analysis data takes place.
Starting with Wireshark version 2.3, the lost frames can be made visible. If
an affected pcap file is opened in Wireshark, the entry
(1)
"Buffer
overflow" (frames will be dropped until next buffer recovery)
and the
corresponding timestamp appear in the frame view, indicating that Ethernet
frame losses have occurred since this time. This means that no more
frames could be saved or individual frames were discarded. The entry
(2)
"Buffer recovery" (Frame reception has recovered)
and the
corresponding time stamp indicate that the system has recovered, the
network load has decreased and full write capacity has been reached
again. From this point on, all Ethernet frames could be received again
without gaps. The following screenshot shows the two events that mark the
beginning and end of the buffer overflow. Before the entry
(1)
or after the
entry
(2)
, all frames are received completely, in between Ethernet frame
losses must be assumed.
Figure 12: Buffer overflow
netANALYZER device NANL-B500G-RE | Installation, operation and hardware description
DOC091110UM26EN | Revision 26 | English | 2019-07 | Released | Public
© Hilscher 2007-2019
