1

I am trying to start two different tshark process with the following python script.

import pyshark
import subprocess

packet_count_pyshark = 0
packet_count_tshark = 0

tsharkCall = ["tshark", "-i", "Wi-Fi", "-w", "tshark_capture" + ".pcap"]
print("Starting TShark")
tshark_process = subprocess.Popen(tsharkCall, stderr=subprocess.DEVNULL)
print("Starting Pyshark")
capture = pyshark.LiveCapture(interface='Wi-Fi')
for packet in capture.sniff_continuously():
    packet_count_pyshark += 1
    print("Pyshark : ", packet_count_pyshark)

After executing the script I opened 10 different youtube videos from browser to create a huge traffic. After waiting around 30 seconds. I cut the program flow with CTRL+C. I saw that the last packet count captured by the pyshark is 6672 however, the number of packets in the tshark pcapng file is 63916. There is a huge gap between the two. I wonder the what is this originated from? Am I doing/understanding something wrong? Any idea is appreciated. Issue is also present at github > https://github.com/KimiNewt/pyshark/issues/375

My Pyshark version is 0.4.2.9 and my TShark version is TShark (Wireshark) 3.0.0 (v3.0.0-0-g937e33de)

rok
  • 9,403
  • 17
  • 70
  • 126
I.K.
  • 414
  • 6
  • 18

1 Answers1

1

Im not sure, but i think tshark does it job much faster then pyshark, the point that you are printing while looping, is probably taking alot of time, which lead pyshark to drop packet, cause the NIC buffer is getting full, and also they starts in diffrerent times, which can also lead to difference

Reznik
  • 2,663
  • 1
  • 11
  • 31
  • I am not sure about the network interface card buffer and yes it can be the origin of the problem. But I can say that, as I leave the program working, the gap between the two enlarges. So I dont think it is because they are started at different times. I will try to check NIC buffer to see if there is a problem. Thanks. – I.K. Oct 14 '19 at 07:41
  • @I.K. I think you should check it without the printing, let it run in a loop for like 2 minutes, and check the result of both, the print can take alot for time in term of capturing packets, print only the counter after 2 minutes – Reznik Oct 14 '19 at 09:20