Re: pcap_dispatch on linux 2.6 with libpcap 1.1.1

[Guy Harris <guy () alum mit edu>]

On Aug 23, 2010, at 3:54 PM, Jim Lloyd wrote:

> What is the relationship between the socket receive buffer and the
> mmap buffer? Does the mmap buffer replace the socket receive buffer,

Yes.

> I currently have my primary testing
> machine configured with
>
> net.core.rmem_default = 4194304
> net.core.rmem_max = 16777216
>
> Do we expect the rmem_default setting to be significant or not?

No.

> Can you recommend any
> traffic generators that can provide test traffic with SACKs?

Unfortunately, no.  (That doesn't mean they don't exist, it just means I don't know what traffic generators are out 
there, or which of them provide test traffic with SACKs.)

> Is there any way to detect these kinds of drops with Linux? It looks like
> the receive drops column in /proc/net/dev might be this count. Can you
> confirm?

I was mistaken - on Linux, at least in libpcap 1.1.x, if you're capturing in promiscuous mode, libpcap *does* fetch the 
drop count from /proc/net/dev and put it into the ps_ifdrop field of the result of pcap_stats().  I don't know why 
that's restricted to promiscuous mode.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.