On Sun, Jul 08, 2001 at 09:17:55PM +0000, ashley thomas wrote:
> This I believe has to do with, how IP accounting is done by libpcap on
> different OSs. I get a very high rate of packet drops on OpenBSD. On Linux, I
> do not see that same high level of packet drops. The newer versions of libpcap
> are supposed to do well with IP accounting.
What do you mean by "IP accounting"?
If you are referring to asking the kernel to supply counts of dropped
packets (which I wouldn't call "IP accounting", as, when you're
capturing packets, the packets aren't dropped by the IP layer, and they
may not even be IP packets), then the tcpdump.org versions of libpcap
don't currently use the mechanism that the 2.4[.x] Linux kernels provide
to get counts of dropped packets, so I wouldn't expect the latest
libpcap to do a better job of reporting statistics on dropped packets
than earlier versions.
(I also wouldn't expect any version to do a good job on pre-2.4 kernels
that don't have the Kuznetzov turbopacket patch, as those kernels don't
have the mechanism in question, and libpcap *can't* dig that information
out of the kernel using that mechanism.)
> All along I thought this was the function of the kernel.
Counting dropped packets *is* a function of the kernel.
Getting those counts from the kernel into userland, in applications that
use only the libpcap interfaces and don't directly use kernel
interfaces, is a function of libpcap.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
