try increasing the B parameter to 16k
try writing the output to a file (-w filename) and watch for dropped packets
there, then read it to see the numbers with
tcpdump -nn -r filename |cut -c 1-8 |uniq -c
(no need for filters as the contents of the file were already filtered)
it's interesting that with the higher packet rate, your actually get fewer
packets successfully received most of the time.
David Lang
On Tue, 1 Oct 2013, Robert wrote:
At 300k EPS:
[rcortiz@simon ~]$ sudo nice -10 /usr/sbin/tcpdump -i eth2.10 -s 90 -nn port
514 -B 8192 | cut -c 1-8 | uniq -c
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth2.10, link-type EN10MB (Ethernet), capture size 90 bytes
117094 17:21:20
257032 17:21:21
222266 17:21:22
246209 17:21:23
246292 17:21:24
246479 17:21:25
246313 17:21:26
246372 17:21:27
1994923 packets captured
2499445 packets received by filter
438362 packets dropped by kernel
Robert
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
_______________________________________________
rsyslog mailing list
http://lists.adiscon.net/mailman/listinfo/rsyslog
http://www.rsyslog.com/professional-services/
What's up with rsyslog? Follow https://twitter.com/rgerhards
NOTE WELL: This is a PUBLIC mailing list, posts are ARCHIVED by a myriad of
sites beyond our control. PLEASE UNSUBSCRIBE and DO NOT POST if you DON'T LIKE
THAT.
