Date: Thu, 12 Feb 2004 15:53:27 -0600 From: "Guy Helmer" <ghelmer@palisadesys.com> To: "Emre Bastuz" <info@emre.de>, <freebsd-net@freebsd.org> Subject: RE: 4.9-STABLE heavily dropping packets? libpcap issue? Message-ID: <FPEBKMIFGFHCGLLKBLMMMENNCDAA.ghelmer@palisadesys.com> In-Reply-To: <1076622177.584b09df25514@webmail.emre.de>
next in thread | previous in thread | raw e-mail | index | archive | help
Emre Bastuz wrote on Thursday, February 12, 2004 3:43 PM
> Hi,
>
> for sniffing purposes I have a FreeBSD 4.9-STABLE box running on highend,
> state-of-the-art hardware (Xeon something) with all bells and whistles.
>
> The NICīs an onboard copper em0 with gig-e capabilities.
>
> Nevertheless I am getting massive packet drops (40%-60%) when I
> start sniffing a
> gigabit ehthernet segment although the CPU load is very low.
>
> After doing some research in in the appropriate mailing list
> archives I found
> out that there are (or were?) sometimes issues with the libpcap.
> As there was a
> more current one in the ports collection (0.8.1 as opposed to 0.7
> in the base
> system) I used this instead (with LIBPCAP_OVERWRITE_BASE=yes) but
> still I am
> losing the same amount of packets when doing a tcpdump.
I don't know what libpcap in ports does regarding the size of the packet
capture read buffer, but I've modified the stock libpcap's pcap-bpf.c so it
offers to use a buffer much larger than 32768 bytes (look for the loop that
has the line
for (v = 32768; v != 0; v >>= 1) {
and increase 32768 to something more reasonable (say, 1048576).
I've also set the debug.bpf_bufsize and debug.bpf_maxbufsize sysctls to
match the number in pcap-bpf.c.
Maybe this will help,
Guy Helmer
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?FPEBKMIFGFHCGLLKBLMMMENNCDAA.ghelmer>