System Performance and Packet Loss

Losing packets means that the Network Analyzer is not able to collect as many network packets as are received by the system. If the network driver cache is full, the driver will reject incoming packets and increase a lost packets counter. This value is saved in the next packet that is not rejected. You can see the number of packets that were lost between a packet and its predecessor in the Time/Length column of the packet list view. The packet source view displays the number of packets that were lost on each network card since the application started (Total Lost) and since the last collection started that used the network card (Lost Packets).

If any filters are active (capture and/or view filters), the number of lost packets will be summed up and added to the next packet that is displayed in the packet list. That way you will always know where you can trust your data and where you may have lost some information.

Note: The number of lost packets is saved together with the packet contents on disk. But if you save only selected or filtered packets, some of this information may get lost. So if you lost some packets and need to know where these packets were lost, you should always save all packets to disk (see Saving and Loading Data).

If the Network Analyzer loses packets, this can have multiple reasons:

1. Too many other applications are running on your computer. Your CPU load needn't be near 100% in this case. You may already lose packets if another application frequently accesses the system bus. Try to close some other applications in this case or use a different computer for analyzing your network traffic. Especially running an online virus scanner and the Network Analyzer on the same machine may significantly increase the CPU load.

2. Your system is too slow. Try to use a capture filter, but in most cases you need to use a more powerful computer to collect network data.

3. Too many collecting documents are open at once. This will rarely happen as the packet dispatcher and the packet filters of the Network Analyzer are highly optimized. But if you have multiple network interface cards in your system, try to collect data only from one card at a time.

4. Insufficient memory: Each document that collects data from the network needs about its buffer size plus 50% of your system's memory. If there is not enough free memory, Windows will swap parts of the used memory to disk, which will considerably degrade the system performance. In this case, try to close other applications, use less documents at a time, or reduce the buffer size when creating documents.