1

I am wondering exactly what happens internally in TShark when I use a capture filter. Specifically, let's say I have the following filter to capture multicast data:

host 224.0.26.3 && port 12345

Does wireshark:

  1. Ask the OS to copy all packets on the interface to its local buffer
  2. Apply the capture filter
  3. Record the data

or

  1. Ask the OS only to copy all packets on the interface from host 224.0.26.1 and port 12345 to its local buffer, then . . .
  2. Record the data

or something else entirely?

2 Answers 2

2

On most operating systems, it's

  1. Ask the OS only to copy all packets on the interface from host 224.0.26.1 and port 12345 to its local buffer, then . . .

  2. Record the data

although what Wireshark and TShark do is run dumpcap (part of Wireshark) with the interface(s) on which to capture and the filter to use as command-line arguments, and dumpcap asks libpcap to ask the OS (or, on Windows, the WinPcap driver) to copy all packets that match the filter to its local buffer.

On some operating systems (for example, Solaris prior to Solaris 11, HP-UX, and IRIX), the OS can't do the filtering in the kernel, so libpcap asks the OS to provide all packets to it, and it (libpcap) runs the filter itself and only supplies packets that match the filter to its caller - dumpcap, in the case of Wireshark and TShark.

1
  • It's informative to know that certain operating systems don't support the kernel filtering. I suspected this would be the case, but I had no evidence to support it, so I kind of left it open in my answer. Sep 27, 2014 at 13:25
1

Wireshark has two types of filters: display filters, and capture filters.

Display filters are more flexible than capture filters (there are some things that capture filters can't do) because display filters look at the data after it has already been copied over to wireshark's packet log.

Capture filters can be a huge benefit to performance if you have lots of separate flows of data going through your network interface, but you only want to capture a small amount of it. The data never gets copied to wireshark if it fails to match the capture filters.

You can actually try this and feel the performance difference in the UI (and observe the performance difference in CPU usage) by doing something like this:

  1. Start up a fast web server on localhost.
  2. Start an enormous HTTP file download (gigabytes of data).
  3. Capture on the localhost network interface with a capture filter that ignores the port where the huge download is taking place.
  4. Clear the capture filter completely, and compare the performance and CPU usage in Step 3 to setting the same sort of filter on the display filter side.

IIRC, Wireshark dumps its packet caps to disk (so it doesn't go OOM), so probably the bottleneck that occurs with "too wide" capture filters is with your disk subsystem having to log everything going on on your network interface.

This is why, if you're wiresharking a very busy server just to observe one specific flow or process, it is essential to set reasonable capture filters. Otherwise wireshark will introduce significant CPU load and I/O throughput.

On Windows anyway, the implementation of packet capturing occurs mostly on the kernel side. Wireshark uses a tool called WinPcap, a kernel module, which actually compiles your capture filters into native code at runtime to create an extremely optimized test for whether or not the capture filter is matching or not. If the filter doesn't match, the packet never gets copied to wireshark's process space.

The implementation of the pcap kernel side backend could vary across platforms, and thus, so could its performance and efficiency.

3
  • This doesn't specifically address my question. What I'm trying to figure out is exactly what Wireshark (TShark in this case) is doing at the OS level, to figure out how multiple captures on the same box scale.
    – Chuu
    Sep 26, 2014 at 16:52
  • Impossible to know without stating your exact operating system and wireshark/tshark version. See my edit. I can basically say with confidence that no data is copied from the kernel to userspace (so, no context switch) in the case of a packet not matching a capture filter, in the case of Windows' WinPcap backend. No clue about how it works on Linux, BSD, etc. You would have to look at the kernel source code for the relevant capture drivers. Sep 26, 2014 at 16:56
  • Note that by "no data" I mean that the payload of the packet is not captured. For various technical reasons it may be required to copy the packet header to userspace, or for the kernel to tell wireshark that it skipped a packet, but this is a communication/coordination message, rather than the actual data payload. The data payload is only copied on a positive match. Sep 26, 2014 at 17:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .