On Sun, Sep 23, 2001 at 04:00:05PM +0430, Mehdi Kianpour wrote:
> About differences between winpcap and libpcap that I pointed out
> before; I had run tcpdump on a 100 Mb/s network with about 6-8%
> utilization for 5 minutes. At last it was printed: 135906 packets
> received by filter, 0 packets dropped by Kernel.
Yes, but, unless you're running an OS that allows libpcap to find out
how many packets were dropped, and a version of libpcap that uses the
OS's mechanism for getting that, it'll report "0 packets dropped by
kernel" even if the kernel *has* dropped packets.
Linux kernels prior to 2.4 don't allow libpcap to find out how many
packets were dropped, unless they have Alexey Kuznetzov's "turbopacket"
patches. The mechanism that the "turbopacket" patches adds is also
present in 2.4 kernels.
What kernel were you running?
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
