Re: [tcpdump-workers] How to set snaplen for tcpdump

the proto‐ col information you're interested in. Setting snaplen to 0 means use the required length to catch whole packets. So -s is the command-line option you want to use! regards Fabian Schneider -- Fabian Schneider, Technische

Re: [tcpdump-workers] where does PCAP timestamp before or after the

scheduler? I have not yet heard of it. mfG Fabian Schneider -- Fabian Schneider, Technische Universität München address: Boltzmannstr. 3, 85748 Garching b. Münchenn e-mail: [EMAIL PROTECTED], WWW: http://www.net.in.tum.de/~schneifa phone: +49 89 289-18012, mobile: 0179/2427671

Re: [tcpdump-workers] How to make libpcap work in MMAP mode

use PCAP_FRAMES=max with the mmaped version for maximal effeiciency. For more detail take a look at: http://public.lanl.gov/cpw/ regards Fabian Schneider -- Fabian Schneider, Technische Universität München address: Boltzmannstr. 3, 85748 Garching b. Münchenn e-mail: [EMAIL PROTECTED

Re: [tcpdump-workers] pcap_loop() not returning after pcap_breakloop()

, terminate the thread (unless a cleanup handler never returns). And this sound like a dirty hack, where additional effort is required to perform the normal cleanup at the end. regards Fabian Schneider -- Fabian Schneider, Technische Universität München address: Boltzmannstr. 3, 85748 Garching

Re: [tcpdump-workers] Filter complexity and performance

://www.net.informatik.tu-muenchen.de/~schneifa/papers/da.pdf (on page 40 (in Document count) section 6.3.1) bye Fabian -- Fabian Schneider (Dipl. Inf.), An-Institut Deutsche Telekom Laboratories Technische Universitaet Berlin, Fakultaet IV -- E-Technik und Informatik address: Sekr. TEL 4

Re: [tcpdump-workers] Packet capture performance comparison of

such a box and come up with some performance statistics? We are hopefully going to do this soon, but i cannot promise a date. best Fabian -- Fabian Schneider (Dipl. Inf.), An-Institut Deutsche Telekom Laboratories Technische Universitaet Berlin, Fakultaet IV -- E-Technik und Informatik address

Re: [tcpdump-workers] NIC / driver performance with libpcap

on this topic. best Fabian [1] http://www.net.t-labs.tu-berlin.de/papers/SWF-PCCH10GEE-07.pdf [2] http://www.net.t-labs.tu-berlin.de/papers/S-PEPCSHN-05.pdf -- Fabian Schneider (Dipl. Inf.), An-Institut Deutsche Telekom Laboratories Technische Universitaet Berlin, Fakultaet IV -- E-Technik und

Re: [tcpdump-workers] pcap performance question

Sections 6.3.2 and 6.3.3 in my thesis: http://www.net.t-labs.tu-berlin.de/~fabian/papers/da.pdf best Fabian Schneider -- Fabian Schneider (Dipl. Inf.), An-Institut Deutsche Telekom Laboratories Technische Universitaet Berlin, Fakultaet IV -- E-Technik und Informatik address: Sekr. TEL 4

Re: [tcpdump-workers] pcap_setbuf not available in linux

Hi Ritesh, 1. In this I want to set the kernel buffer for pcap driver, for this function pcap_setbuff is not available, but this same function is available in windows. So how we can set the pcap driver packet queue kernel buffer in linux? Is their any way through which we can include the

Re: [tcpdump-workers] Multiple pcap filters on interface

] http://read.cs.ucla.edu/click/ -- Fabian Schneider (Dipl. Inf.), An-Institut Deutsche Telekom Laboratories Technische Universitaet Berlin, Fakultaet IV -- E-Technik und Informatik address: Sekr. TEL 4, Ernst-Reuter-Platz 7, 10587 Berlin e-mail: [EMAIL PROTECTED], WWW: http://www.net.in.tum.de

Re: [tcpdump-workers] Best OS / Distribution for gigabit capture?

Hi, Regarding the OS we have done testing on this some five years ago. Back then we found that FreeBSD performed better than Linux. Yet there have been improvements proposed for both Linux (memory mapping, and Luca Deri's work) and FreeBSD (zero-copy BPF and Alexandre Fiveg's work). To get

Re: [tcpdump-workers] Where does libpcap get the incoming network data? From the driver?

Hi, that depends on the OS. 1. Does libpcap obtain incoming packet data from the nic's driver or from somewhere else? 2. Does libpcap obtain outgoing packet data from the linux IP layer or from somewhere else? Actually it is in between. What happens is that libpcap requests a PF_PACKET