From owner-freebsd-net@FreeBSD.ORG Thu Feb 12 13:43:00 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 76D5616A4CE for ; Thu, 12 Feb 2004 13:43:00 -0800 (PST) Received: from webmail.emre.de (webmail.emre.de [194.8.203.50]) by mx1.FreeBSD.org (Postfix) with ESMTP id 38F8C43D1F for ; Thu, 12 Feb 2004 13:43:00 -0800 (PST) (envelope-from info@emre.de) Received: by webmail.emre.de (Postfix, from userid 80) id E454D3A23E; Thu, 12 Feb 2004 22:42:57 +0100 (CET) Received: from 192.168.2.2 ([192.168.2.2]) by webmail.emre.de (Horde) with HTTP for ; Thu, 12 Feb 2004 22:42:57 +0100 Message-ID: <1076622177.584b09df25514@webmail.emre.de> Date: Thu, 12 Feb 2004 22:42:57 +0100 From: Emre Bastuz To: freebsd-net@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1" Content-Disposition: inline Content-Transfer-Encoding: quoted-printable User-Agent: Internet Messaging Program (IMP) 4.0-cvs Subject: 4.9-STABLE heavily dropping packets? libpcap issue? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Feb 2004 21:43:00 -0000 Hi, for sniffing purposes I have a FreeBSD 4.9-STABLE box running on highend, state-of-the-art hardware (Xeon something) with all bells and whistles. The NIC=B4s an onboard copper em0 with gig-e capabilities. Nevertheless I am getting massive packet drops (40%-60%) when I start sniffi= ng a gigabit ehthernet segment although the CPU load is very low. After doing some research in in the appropriate mailing list archives I foun= d out that there are (or were?) sometimes issues with the libpcap. As there wa= s a more current one in the ports collection (0.8.1 as opposed to 0.7 in the bas= e system) I used this instead (with LIBPCAP_OVERWRITE_BASE=3Dyes) but still I = am losing the same amount of packets when doing a tcpdump. I definitly do _not_ know what else I can do to reduce the amount of lost da= ta. *sigh* Things I did to improve the situation so far: - Update from RELEASE to 4.9-STABLE - Compile a custom kernel with reduced drivers and SMP support - Update libpcap and recompile tcpdump Does any of you have an idea else I can do? Any parameters in the kernel that can be tweeked further, like NMBCLUSTERS o= r NMBUFS? Cheers, Emre -- http://www.emre.de UIN: 561260 PGP Key ID: 0xAFAC77FD I don't see why some people even HAVE cars. -- Calvin ---------------------------------------------------------------- This message was sent using IMP, the Internet Messaging Program.