1

This discussion reveals that Wireshark may not capture every packet on a network. In that case, the reason pertains to TCP data.

I am specifically interested in seeing (extremely bulky) GVSP data. As I understand it, this is based on UDP. I would have thought that even if Wireshark had no filter available for GVSP data, it would at least offer me the UDP data. But I don't see any data at all, despite being absolutely it is transmitted. Why not?

In my situation, I have a PLC triggering a camera regularly, which duly sends its images via GVSP to a host on an isolated network. Also, the PLC sends a UDP packet per trigger event down another isolated network to the same host. On that host, I run Wireshark, I capture on both channels simultaneously, and I see (1) visual evidence of the camera images arriving, (2) Wireshark evidence of the regular UDP packets, and (3) GVCP data from the camera. But the GVSP data is missing. What do I need to do to see this data?

  • Please post the wireshark captuire to discuss further – marctxk Sep 16 '16 at 9:45
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 15 '17 at 2:28
1

I managed to show them (as UPD protocol packets) by disabling the Vimba GigE Vision Filter Driver, thanks to the answers in the rest of this post.

enter image description here

  • Note that this may affect the performance of your data stream so be sure to set it back when you're done debugging. – titusjan Jun 7 at 15:28
1

If you are the computer that is the receiver of the traffic you want too capture (which is what it sounds like you are) maybe its there and a proper filter will help. I've read that GVSP can show as UDP. Here are some wireshark filters for GVSP.

GVSP Wireshark filters

If you know your setup correctly first make sure firewalls are off. There may be Features on your nic that need changed. In windows you can go under device manager, networking devices and right click your nic. Go to properties and see what features are enabled or disabled. A common one that needs disabled is TCP Chimney that blocks winpcap after handshakes. Refrence is here

You can run this to turn it off under a command prompt/terminal window.

netsh int ip set chimney disabled
0

deactivate the FilterDriver in the Ethernet Properties...

For example "siNetFilter GigE Vision Filter Driver".

0

The GigE Vision standard consists of two protocols. GVCP to control the camera parameter which is passed through all the filter driver and the GVSP streaming protocol that transmits the image data. To better control those image data and pass them predictable and with good performance its packets will be tapped by the corresponding filter driver and bypass NDIS and further filter. As this is a filter driver internal mechanism one can only ask the driver supplier if it can be deactivated by command. Then it would be seen with Wireshark but streaming performance may decrease in the meantime.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.