On Linux you wo'nt see packet drops.
pcap_stat() call always return 0.
OpenBSD returns the correct value.
On 0, ashley thomas <[EMAIL PROTECTED]> wrote:
> I am using OpenBSD OS and am running libpcap0.6.2
>
> When i run tcpdump as:
>
> tcpdump "port imap"
> and after sometime kill it. It shows:
>
> 42 packets received by filter
> 0 packets dropped by kernel
>
> where as when on the same network when i run tcpdump (tcpdump "port imap")
> on a linux 2.2.16 OS it shows
> 0 packets received by filter
>
> I think the BSD is showing some wrong info. It is infact showing the total
> number of packets on the network rather than the ones caught using the filter.
>
> I think the pcap_stats call is returning a false information. I tried getting
> this info using a small program.
>
> Is it a known problem. Is there a fix for it ?
>
This I believe has to do with, how IP accounting is done by libpcap on
different OSs. I get a very high rate of packet drops on OpenBSD. On Linux, I
do not see that same high level of packet drops. The newer versions of libpcap
are supposed to do well with IP accounting. All along I thought this was the
function of the kernel.
--
Subba Rao
[EMAIL PROTECTED]
http://members.home.net/subba9/
GPG public key ID 27FC9217
Key fingerprint = 2B4C 498E 1860 5A2B 6570 5852 7527 882A 27FC 9217
Ashley Thomas
1713 Crest road #1
Raleigh NC 27606
phone (919)-829-3576
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
