On Thu, Jan 24, 2002 at 06:28:51PM -0800, Philip Rakity wrote: > b) Select show frames in real time.... They come in in bursts. Its as if > someone is buffering the data before handing a set of frames to etherreal.
Ethereal, when opening the capture stream, specifies a "timeout" of 250 milliseconds (1/4 second) - on some platforms (including platforms using BPF, of which MacOS X is, not surprisingly, one), this means that packets may be buffered for up to 1/4 second before Ethereal receives them (so that it can get more than one packet per read, for efficiency reasons). In addition, the mechanism by which, in an "Update list of packets in real time" capture, the child process doing the capture sends a message to the parent process telling it that more packets have arrived causes updates to be done only once a second - and, in all captures, the updates to the counts of packets is also done only once per second, "so as not to overload slow displays" (to quote the comment in the code).
