From owner-freebsd-net@FreeBSD.ORG Thu Feb 12 13:53:32 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 7305716A4CE for ; Thu, 12 Feb 2004 13:53:32 -0800 (PST) Received: from magellan.palisadesys.com (magellan.palisadesys.com [192.188.162.211]) by mx1.FreeBSD.org (Postfix) with ESMTP id 42D7A43D31 for ; Thu, 12 Feb 2004 13:53:32 -0800 (PST) (envelope-from ghelmer@palisadesys.com) Received: from mira (mira.palisadesys.com [192.188.162.116]) (authenticated bits=0)i1CLrTKw008474 (version=TLSv1/SSLv3 cipher=RC4-MD5 bits=128 verify=NO); Thu, 12 Feb 2004 15:53:29 -0600 (CST) (envelope-from ghelmer@palisadesys.com) From: "Guy Helmer" To: "Emre Bastuz" , Date: Thu, 12 Feb 2004 15:53:27 -0600 Message-ID: MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 8bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal X-Mailer: Microsoft Outlook IMO, Build 9.0.6604 (9.0.2911.0) Importance: Normal In-Reply-To: <1076622177.584b09df25514@webmail.emre.de> X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1165 Subject: RE: 4.9-STABLE heavily dropping packets? libpcap issue? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Feb 2004 21:53:32 -0000 Emre Bastuz wrote on Thursday, February 12, 2004 3:43 PM > Hi, > > for sniffing purposes I have a FreeBSD 4.9-STABLE box running on highend, > state-of-the-art hardware (Xeon something) with all bells and whistles. > > The NICīs an onboard copper em0 with gig-e capabilities. > > Nevertheless I am getting massive packet drops (40%-60%) when I > start sniffing a > gigabit ehthernet segment although the CPU load is very low. > > After doing some research in in the appropriate mailing list > archives I found > out that there are (or were?) sometimes issues with the libpcap. > As there was a > more current one in the ports collection (0.8.1 as opposed to 0.7 > in the base > system) I used this instead (with LIBPCAP_OVERWRITE_BASE=yes) but > still I am > losing the same amount of packets when doing a tcpdump. I don't know what libpcap in ports does regarding the size of the packet capture read buffer, but I've modified the stock libpcap's pcap-bpf.c so it offers to use a buffer much larger than 32768 bytes (look for the loop that has the line for (v = 32768; v != 0; v >>= 1) { and increase 32768 to something more reasonable (say, 1048576). I've also set the debug.bpf_bufsize and debug.bpf_maxbufsize sysctls to match the number in pcap-bpf.c. Maybe this will help, Guy Helmer