3

This discussion reveals that Wireshark may not capture every packet on a network. In that case, the reason pertains to TCP data.

I am specifically interested in seeing (extremely bulky) GVSP data. As I understand it, this is based on UDP. I would have thought that even if Wireshark had no filter available for GVSP data, it would at least offer me the UDP data. But I don't see any data at all, despite being absolutely it is transmitted. Why not?

In my situation, I have a PLC triggering a camera regularly, which duly sends its images via GVSP to a host on an isolated network. Also, the PLC sends a UDP packet per trigger event down another isolated network to the same host. On that host, I run Wireshark, I capture on both channels simultaneously, and I see (1) visual evidence of the camera images arriving, (2) Wireshark evidence of the regular UDP packets, and (3) GVCP data from the camera. But the GVSP data is missing. What do I need to do to see this data?

Improve this question
2
  • Please post the wireshark captuire to discuss further
    – marctxk
    Commented Sep 16, 2016 at 9:45
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Commented Aug 15, 2017 at 2:28

4 Answers 4

Reset to default
2

I managed to show them (as UPD protocol packets) by disabling the Vimba GigE Vision Filter Driver, thanks to the answers in the rest of this post.

enter image description here

Improve this answer
2
  • 1
    Note that this may affect the performance of your data stream so be sure to set it back when you're done debugging.
    – titusjan
    Commented Jun 7, 2019 at 15:28
  • I would like to add: Depending on the FilterClass and installation date, it might be possible that you can see GigE packages that are tapped by your GigE filterdriver in your Wireshark traces. E.g., our filterdriver is of FilterClass 'compression', which is the same as the FilterClass of the NPCAP driver. Depending on which driver was installed first, the traces will appear in Wireshark. You can check the FilterClass in the inf file of the driver. More information here: docs.microsoft.com/en-us/windows-hardware/drivers/network/…
    – aMKa
    Commented Aug 27, 2020 at 8:49
1

If you are the computer that is the receiver of the traffic you want too capture (which is what it sounds like you are) maybe its there and a proper filter will help. I've read that GVSP can show as UDP. Here are some wireshark filters for GVSP.

GVSP Wireshark filters

If you know your setup correctly first make sure firewalls are off. There may be Features on your nic that need changed. In windows you can go under device manager, networking devices and right click your nic. Go to properties and see what features are enabled or disabled. A common one that needs disabled is TCP Chimney that blocks winpcap after handshakes. Refrence is here

You can run this to turn it off under a command prompt/terminal window.

netsh int ip set chimney disabled
Improve this answer
0
1

deactivate the FilterDriver in the Ethernet Properties...

For example "siNetFilter GigE Vision Filter Driver".

Improve this answer
0
1

The GigE Vision standard consists of two protocols. GVCP to control the camera parameter which is passed through all the filter driver and the GVSP streaming protocol that transmits the image data. To better control those image data and pass them predictable and with good performance its packets will be tapped by the corresponding filter driver and bypass NDIS and further filter. As this is a filter driver internal mechanism one can only ask the driver supplier if it can be deactivated by command. Then it would be seen with Wireshark but streaming performance may decrease in the meantime.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.