From owner-freebsd-net@FreeBSD.ORG Thu Feb 12 14:49:06 2004 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B2EC716A4CE for ; Thu, 12 Feb 2004 14:49:06 -0800 (PST) Received: from rms04.rommon.net (rms04.rommon.net [212.54.2.140]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2985143D1D for ; Thu, 12 Feb 2004 14:49:06 -0800 (PST) (envelope-from pete@he.iki.fi) Received: from he.iki.fi (h81.vuokselantie10.fi [193.64.42.129]) by rms04.rommon.net (8.12.9p1/8.12.9) with ESMTP id i1CMmxcM074175; Fri, 13 Feb 2004 00:48:59 +0200 (EET) (envelope-from pete@he.iki.fi) Message-ID: <402C029B.30103@he.iki.fi> Date: Fri, 13 Feb 2004 00:47:55 +0200 From: Petri Helenius User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko/20040113 X-Accept-Language: en-us, en MIME-Version: 1.0 To: Guy Helmer References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 8bit cc: freebsd-net@freebsd.org cc: Emre Bastuz Subject: Re: 4.9-STABLE heavily dropping packets? libpcap issue? X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 12 Feb 2004 22:49:06 -0000 Guy Helmer wrote: >Emre Bastuz wrote on Thursday, February 12, 2004 3:43 PM > > >>Hi, >> >>for sniffing purposes I have a FreeBSD 4.9-STABLE box running on highend, >>state-of-the-art hardware (Xeon something) with all bells and whistles. >> >>The NICīs an onboard copper em0 with gig-e capabilities. >> >>Nevertheless I am getting massive packet drops (40%-60%) when I >>start sniffing a >>gigabit ehthernet segment although the CPU load is very low. >> >>After doing some research in in the appropriate mailing list >>archives I found >>out that there are (or were?) sometimes issues with the libpcap. >>As there was a >>more current one in the ports collection (0.8.1 as opposed to 0.7 >>in the base >>system) I used this instead (with LIBPCAP_OVERWRITE_BASE=yes) but >>still I am >>losing the same amount of packets when doing a tcpdump. >> >> > >I don't know what libpcap in ports does regarding the size of the packet >capture read buffer, but I've modified the stock libpcap's pcap-bpf.c so it >offers to use a buffer much larger than 32768 bytes (look for the loop that >has the line > > for (v = 32768; v != 0; v >>= 1) { > >and increase 32768 to something more reasonable (say, 1048576). > >I've also set the debug.bpf_bufsize and debug.bpf_maxbufsize sysctls to >match the number in pcap-bpf.c. > > > This is also fixed in more current libpcap version, however that has not been ported to the tree. Pete