I think you're just getting lucky. There's a long-standing bug complaining that the synchronization between interfaces, well, isn't:
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8253 On Tue, Feb 6, 2018 at 12:07 PM, S. Jacobi <[email protected]> wrote: > On Tue, 6 Feb 2018 09:05:14 -0800 > Richard Sharpe <[email protected]> wrote: > > > On Tue, Feb 6, 2018 at 8:39 AM, S. Jacobi <[email protected]> > > wrote: > > > We have a sender who send packets, each one gets a 16bit number. > > > This number, I will call it packet ID, is strictly ascending, but > > > starts again from zero if the 16bit range is reached. > > > Then, the sender distributes the packet on multiple interfaces and > > > we cannot make any assumptions how this is done. Packet IDs can > > > appear arbitrarily on the interfaces, packet IDs can be reordered > > > (although only in a very limited range), and packets need not be > > > (and in fact are not) evenly divided onto the interfaces. > > > On the receiving > > > Our own capturing tool is rather simple. It spawns a thread for each > > > interface, and the thread functions tries to read and process each > > > incoming packet as fast as possible. This leads to the problem that > > > if one interface receives more packets, the packet IDs read from > > > different interfaces drift further apart, even going one full > > > circle and so on and on. > > > However, if we use tshark to capture from all interfaces and save > > > the output to a file, the process this file with our tool, > > > everything works fine. > > > So, tshark needs to have some sort of synchronisation mechanism, to > > > fairly distribute the reads from each interface. The packet > > > timestamps in the capture file are not always ascending, there are > > > a few jumps in it. > > > I wasn't able to spot this mechanism in the code, so I'm grateful > > > for any information on this. > > > > As far as I am aware it is the kernel that is doing this. Also, I > > believe that only Linux supports the any device. > > > > We are on Linux, yes, but we don't capture from any. tshark allows to > specify multiple interfaces. > ____________________________________________________________ > _______________ > Sent via: Wireshark-dev mailing list <[email protected]> > Archives: https://www.wireshark.org/lists/wireshark-dev > Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev > mailto:[email protected]?subject= > unsubscribe >
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
