From owner-freebsd-net@FreeBSD.ORG Wed Sep 17 18:42:10 2003 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id D2E2116A4B3 for ; Wed, 17 Sep 2003 18:42:10 -0700 (PDT) Received: from mag.barnet.com.au (mag.barnet.com.au [218.185.88.3]) by mx1.FreeBSD.org (Postfix) with ESMTP id 0DA4143FBD for ; Wed, 17 Sep 2003 18:42:08 -0700 (PDT) (envelope-from edwin@mavetju.org) Received: from extmail.barnet.com.au (tim.direct.int.barnet.com.au [10.10.10.2]) by mag.barnet.com.au (Postfix) with ESMTP id A1647D15; Thu, 18 Sep 2003 11:42:05 +1000 (EST) X-Viruscan-Id: <3F690D6D000035B001A989F3@VIRUSCAN-127.0.0.1> Received: from k7.mavetju (tim.barnet.com.au [218.185.88.1]) by extmail.barnet.com.au (Postfix) with ESMTP id 9ADF81E15; Thu, 18 Sep 2003 11:42:04 +1000 (EST) Received: by k7.mavetju (Postfix, from userid 1001) id B561C6A7101; Thu, 18 Sep 2003 11:42:03 +1000 (EST) Date: Thu, 18 Sep 2003 11:42:03 +1000 From: Edwin Groothuis To: Josh Brooks Message-ID: <20030918014203.GA59403@k7.mavetju> References: <20030917182850.Q52432-100000@mail.econolodgetulsa.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20030917182850.Q52432-100000@mail.econolodgetulsa.com> User-Agent: Mutt/1.4.1i cc: freebsd-net@freebsd.org Subject: Re: I would like to tcpdump and get all the packets... X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 18 Sep 2003 01:42:10 -0000 On Wed, Sep 17, 2003 at 06:31:03PM -0700, Josh Brooks wrote: > Whenever I run: > > tcpdump -vvv > > when I am finished, I am surprised to see: > > 27441 packets received by filter > 7866 packets dropped by kernel That's because the buffer of captures-but-not-yet-processed packets in tcpdump was filled up. In other words, your system is to slow to process the amount of traffic going through your machine. Edwin -- Edwin Groothuis | Personal website: http://www.mavetju.org edwin@mavetju.org | Weblog: http://www.mavetju.org/weblog/weblog.php