On Fri, Mar 21, 2014 at 03:39:16PM +0000, Dave Taht wrote: >>> Is your hardware fast enough to run tcpdump -s 128 -w whatever.cap -i >>> your interface during an entire rrul test without dropping packets? >>> (on client and server) > (question to list) Are there any options to tcpdump or the kernel to > make it more possible to capture full packet payloads (64k) without > loss at these speeds? tshark?
You can capture tens of gigabits of traffic if you use the mmap packet ring stuff. Doubt tcpdump supports it, but it wouldn't be impossible to do. I'm a bit confused if a normal machine these days can't easily saturate gigabit (and capture it to SSD without further problems), though. /* Steinar */ -- Homepage: http://www.sesse.net/ _______________________________________________ Bloat mailing list [email protected] https://lists.bufferbloat.net/listinfo/bloat
