How to tell if application is handling packets too slowly, causing them to be missed?

[Chris Morgan <chmorgan () gmail com>]

I have a case where it appears that packets are being missed or
dropped. I wonder if this is due to too much processing being done in
the pcap_dispatch() handler in my application in cases where there are
bursts of packets like facebook chat messages or website visits.

My question is how to detect this situation at runtime or via a test
case. I thought of using pcap_stats() but I wasn't sure if
pcap_stat.ps_drop was the number of packets that were dropped only due
to buffer overruns due to the application callback not processing
packets quick enough, or if this count referred to duplicate/error
packets and/or packets dropped due to buffer overruns.

If I could identify the issue at runtime that would be even better
since it would avoid cases where optimization now might not be good
enough if more packet analyzers are added to my code in the future,
causing things to again slow down and packets to be dropped.

Chris
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.