On Nov 3, 2004, at 11:34 PM, [EMAIL PROTECTED] wrote:
Um, I'm still not sure if you understand. A normal collision is
detected
during the first 512 bits of the packet. There is no retransmission of
the whole packet in case of collision (and thus no second copy of the
packet). One packet is sent, o
> >A collision on half duplex media (such as a hub) is a *normal* and
> >*expected* occurence, and does *not* cause a packet to be dropped.
>
> >Note that this does not apply to "late collisions" which are quite
> >different - late collisions are signs of *error* (for instance a
> >duplex mismatch
sorry for the late replies, and thanks for the comments.
I sense some fundamental misunderstandings here. Basically:
A collision on half duplex media (such as a hub) is a *normal* and
*expected* occurence, and does *not* cause a packet to be dropped.
Note that this does not apply to "late collisi
-BEGIN PGP SIGNED MESSAGE-
> "Aaron" == Aaron Turner <[EMAIL PROTECTED]> writes:
Aaron> 2) You can check the number of collisions on most Unix/Linux
Aaron> boxes using ifconfig. You'll see a collisions counter which
Aaron> will increment over time. Other errors and stati
-BEGIN PGP SIGNED MESSAGE-
> "Matt" == Matt Van Mater <[EMAIL PROTECTED]> writes:
Matt> Recently I've been investigating why tcpdump on my IDS shows
Matt> quite a few packets as being dropped. I think this is because
Matt> my traffic to the IDS is fed through a hub where
> Recently I've been investigating why tcpdump on my IDS shows quite a few
> packets as being dropped. I think this is because my traffic to the IDS is
> fed through a hub where I know there are many collisions (there may be too
> many packets per second for the little soho 10/100 hub to handle
Matt Van Mater wrote:
Recently I've been investigating why tcpdump on my IDS shows quite a few
packets as being dropped.
Probably because it's receiving so many packets that it can't keep up.
Drops, as reported by tcpdump, are drops due to the buffer in the packet
capture mechanism overflowing d
A few comments:
1) I doubt that collisions are the cause. A collision will actually
prevent tcpdump from seeing the packet and reduce the throughput of the
network, thus tcpdump should drop fewer packets.
2) You can check the number of collisions on most Unix/Linux boxes using
ifconfig. You'll
Hi all,
Recently I've been investigating why tcpdump on my IDS shows quite a few
packets as being dropped. I think this is because my traffic to the IDS is
fed through a hub where I know there are many collisions (there may be too
many packets per second for the little soho 10/100 hub to handle
