Hello I test the last CVS version of tcpdump and libpcap and all work fine.
Once again thanks a lot for your help. Sincerely Cedric Dalmasso FranceTelecom R&D > -----Message d'origine----- > De : dalmasso cedric [mailto:[EMAIL PROTECTED] > Envoyé : mercredi 30 novembre 2005 09:56 > À : zze-DALMASSO Cedric RD-BIZZ-SOP > Objet : Fwd: [tcpdump-workers] 50% received packet are missing > > ---------- Forwarded message ---------- > From: dalmasso cedric <[EMAIL PROTECTED]> > Date: Nov 25, 2005 11:33 AM > Subject: Re: [tcpdump-workers] 50% received packet are missing > To: tcpdump-workers@lists.tcpdump.org > > > Hello, > thanks for all > I don't have access to the machine where the bug occur before > next Wednesday but I test it as soon as possible. > We already see yesterday, there are many times wheres the > count of packets "received by filter" are updated but we > don't go more into detail. > > Again thanks, > > Cedric > > On 11/24/05, Guy Harris <[EMAIL PROTECTED]> wrote: > > dalmasso cedric wrote: > > > > > I use Linux Mandriva 2006 and as I describe in subject > with tcpdump > > > 50% of received packet are missing! I provide many test and it's > > > also the same I capture 1/2 of received packets. > > > > ... > > > > > 923 packets captured > > > 1846 packets received by filter > > > > There's a bug in libpcap 0.9[.x] (and maybe 0.8[.x]) that > causes the > > count of packets "received by filter" to be twice (or approximately > > twice) the number of packets actually received, on systems > with newer > > kernels (kernels supporting the PACKET_STATISTICS socket option on > > PF_PACKET sockets). > > > > So it's not that you're capturing 1/2 of the received packets; it's > > that the reported number of received packets is 2/1 the > actual number > > of received packets. > > > > I've checked in a change that should fix this; if you can get the > > current CVS version of libpcap (and tcpdump) and build them > together > > (unpack both into subdirectories of the same directory, > configure and > > build libpcap, then configure and build tcpdump, so that tcpdump is > > built with the version of libpcap you just built), or get the next > > "current" tarball sfrom tcpdump.org (2005-11-25 or later) when it > > appears on the Web site and try those, see if that fixes > the problem. > > - > > This is the tcpdump-workers list. > > Visit https://lists.sandelman.ca/ to unsubscribe. > > > - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
