Re: Changing the savefiles produces packet loss

[David Rosal <david.rosal () upf edu>]

David Rosal wrote:
> Hello.
>
> I've been capturing heavy traffic with tcpdump.
>
> No packets are dropped except when the savefiles are rotated. I know 
> that because I use a modified version of tcpdump-3.9.4 that prints 
> statistics every minute.
>
> My question is, is it normal to loose packets when closing and opening
> the savefiles? How could I avoid that?

It would help if that would be any way to close the old file 
asynchronously, but I guess that pcap_dump_close() blocks until the 
savefile is closed, isn't it?


*david
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.