A few comments: 1) I doubt that collisions are the cause. A collision will actually prevent tcpdump from seeing the packet and reduce the throughput of the network, thus tcpdump should drop fewer packets.
2) You can check the number of collisions on most Unix/Linux boxes using ifconfig. You'll see a collisions counter which will increment over time. Other errors and statistics are also available. Regards, Aaron On Mon, Nov 01, 2004 at 03:01:46PM -0500, Matt Van Mater wrote: > Hi all, > > Recently I've been investigating why tcpdump on my IDS shows quite a > few packets as being dropped. I think this is because my traffic to > the IDS is fed through a hub where I know there are many collisions > (there may be too many packets per second for the little soho 10/100 > hub to handle). I'm not sure how tcpdump handles collisions, and so I > don't know if this is even a problem or not. > > Is there a way to get more fine grained statistics on why packets are > dropped, and would collisions coming in off a hub be shown as dropped? > I'm seeing a traffic feed of roughly 4000-5000 packets per second and > about 1000 collisions per minute, so I don't think that the rate of > traffic is the cause of my problem. > > If the dropped packets being displayed are just the collisions from > the hub then it's no big deal, but if it's something else I'd like to > try and fix it of course. > > Thanks, > Matt > > > - > This is the tcpdump-workers list. > Visit https://lists.sandelman.ca/ to unsubscribe. -- Aaron Turner <aturner at pobox.com|synfin.net> http://synfin.net/ They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. -- Benjamin Franklin All emails are PGP signed; a lack of a signature indicates a forgery.
signature.asc
Description: Digital signature
