Hi, On Sun, Nov 10, 2013 at 11:50:27AM +0100, Anders Broman wrote: > The upcoming libpcap 1.5 have support for TPACKET_V3 which seems to > improve on packet drops at high sped captures.
Finally ;-) > However some tests on a 1 Gb link with ~900 Mb/s indicates that tcpdump does > better than dumpcap > possibly because dumpcap uses "inpkts = pcap_dispatch(pcap_opts->pcap_h, > 1, capture_loop_write_packet_cb, (u_char *)pcap_opts);" fetching > packets one by one rather than using -1. Try saving in libpcap (not libpcap-ng) format, try to use threads (or not if you were using them). Does it helps? ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
