Hi, It's not clear to me if you are running tcpdump on the server in question, which might not be a good idea if its heavily loaded as tcpdump might add extra load to the machine. You could check with top.
Which OS are you running and what versions of tcpdump/libpcap? What is the packets/s or MB/s? ( Load the capture into Wireshark and look at the Summary information). *Set a snap length (MTU + 18). Depending on your OS and libpcap version this might give a good effect. Regards Anders -----Original Message----- From: tcpdump-workers-boun...@lists.tcpdump.org [mailto:tcpdump-workers-boun...@lists.tcpdump.org] On Behalf Of Eliezer Croitoru Sent: den 25 november 2013 02:04 To: tcpdump-workers@lists.tcpdump.org Subject: [tcpdump-workers] How tcpdump determines the "dropped by kernel"? I have been reading the man pages of tcpdump and I am not sure if my OS will report the relevant info. Since I would not like to research tcpdump code I would like to get some help about it from others. So my kernel would declare on packets that was dropped but still the connection was OK and was not disrupted in any way I can think about. What exactly this "drop by kernel" means? Is it dropped by kernel and was not handled by any application? or it means that the buffers of tcpdump got filled and there-for was dropped by tcpdump? I am not sure I am even asking the right question but this is how it seems to me. In any case I would like to do a very big dump into a storage system on a very loaded system and which I would like to not drop any packet by either the kernel or any other level if possible. In a case there are tuning to the system in couple layers I would like to at least minimize the drops from lots of packets into a small amount of packets. Thanks in Advance, Eliezer _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
