Re: mmap-ed tcpdump and gigabit ethernet

["Dmitry Rubinstein" <Dmitry.Rubinstein () bhive net>]

Sorry, forgot to specify that this is a Linux with kernel 2.6.18-1.2798,
pcap libpcap-0.9.20060417 by Phil Wood and tcpdump 3.9.3 by the same. 


--
Sailing: The fine art of getting wet and becoming ill while slowly going
nowhere at great expense.       

-----Original Message-----
From: tcpdump-workers-owner () lists tcpdump org
[mailto:tcpdump-workers-owner () lists tcpdump org] On Behalf Of Dmitry
Rubinstein
Sent: Monday, January 08, 2007 11:56 AM
To: tcpdump-workers () lists tcpdump org
Subject: [tcpdump-workers] mmap-ed tcpdump and gigabit ethernet

Greetings, all!
 
I would like to have an efficient capturing solution for a gigabit
network. It seems as if Phil Wood's libpcap should do the work. However,
I am not sure as for its support for the jumbo frames. When in MMAP
mode, this version of tcpdump doesn't seem to cope with -s 0 or -s N for
N >> 4000 (terminating with Error: setsockopt(PACKET_RX_RING): Invalid
argument \n tcpdump: malloc: Illegal seek), whereas in the NORMAL mode I
can see frames as large as 9000 bytes (and more). Anyone has had this
problem (and solved it)?
 
Thanks!
 
--
Sailing: The fine art of getting wet and becoming ill while slowly going
nowhere at great expense.       
 
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.