Michele Sciuto wrote: > Since I need the acquired data in libpcap format, I was wondering if it > would be better to use dagsnap followed by dagconvert or, alternatively, > tcpdump with the dag patch. Does somebody know which is the best choice, > considering performance?
IMHO the libpcap patch works fine and a simple pcaploop is enough to capture data and write it in pcap format. take care of the buffering on the disk it can impact your performance. > And again, so far I can see the card as /dev/dag0 and I just used > dagsnap to capture data. Somehow, is it possible to see the dag > interface with ifconfig (I mean configuring it in > /etc/network/interfaces), in order to use netstat to check the counters? you have to use dagfour / dagconfig / dagstat in order to get the counters. the DAG cards are viewed by the system as special device, they are not network interface. bye - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
