Re: Multi process sniffing and dropped packets

[Guy Harris <guy () alum mit edu>]

On Jan 12, 2006, at 5:03 PM, Michael Richardson wrote:

>   You could perhaps, do just load the filter and fork.
>   You'd be sharing the same file descriptor, and if your kernel
> returns one-packet-per-read (some mmap'ed interfaces do not!),

Some non-mmapped interfaces don't, either, e.g. BPF on various BSDs  
and Solaris.  You could arrange that they not buffer packets, but  
that means more wakeups and possibly higher CPU load as a result.

-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.