From owner-freebsd-questions@FreeBSD.ORG  Tue Sep  9 12:21:41 2008
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Delivered-To: freebsd-questions@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34])
	by hub.freebsd.org (Postfix) with ESMTP id B342B1065683
	for <freebsd-questions@freebsd.org>;
	Tue,  9 Sep 2008 12:21:41 +0000 (UTC)
	(envelope-from wojtek@wojtek.tensor.gdynia.pl)
Received: from wojtek.tensor.gdynia.pl (wojtek.tensor.gdynia.pl
	[IPv6:2001:4070:101:2::1])
	by mx1.freebsd.org (Postfix) with ESMTP id B23508FC18
	for <freebsd-questions@freebsd.org>;
	Tue,  9 Sep 2008 12:21:40 +0000 (UTC)
	(envelope-from wojtek@wojtek.tensor.gdynia.pl)
Received: from wojtek.tensor.gdynia.pl (localhost [IPv6:::1])
	by wojtek.tensor.gdynia.pl (8.14.2/8.14.2) with ESMTP id m89CLJQM037480;
	Tue, 9 Sep 2008 14:21:19 +0200 (CEST)
	(envelope-from wojtek@wojtek.tensor.gdynia.pl)
Received: from localhost (wojtek@localhost)
	by wojtek.tensor.gdynia.pl (8.14.2/8.14.2/Submit) with ESMTP id
	m89CLJaf037477; Tue, 9 Sep 2008 14:21:19 +0200 (CEST)
	(envelope-from wojtek@wojtek.tensor.gdynia.pl)
Date: Tue, 9 Sep 2008 14:21:19 +0200 (CEST)
From: Wojciech Puchar <wojtek@wojtek.tensor.gdynia.pl>
To: Mario Lobo <mlobo@digiart.art.br>
In-Reply-To: <30719919.1220960726357.JavaMail.nfsnobody@mailapp02.brturbo.com>
Message-ID: <20080909141945.B37476@wojtek.tensor.gdynia.pl>
References: <30719919.1220960726357.JavaMail.nfsnobody@mailapp02.brturbo.com>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
Cc: freebsd-questions@freebsd.org
Subject: Re: [OT] tcpdump overhead
X-BeenThere: freebsd-questions@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: User questions <freebsd-questions.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-questions>
List-Post: <mailto:freebsd-questions@freebsd.org>
List-Help: <mailto:freebsd-questions-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-questions>, 
	<mailto:freebsd-questions-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Tue, 09 Sep 2008 12:21:41 -0000

>   make is how much overhead tcpdump will have on them (if any). It seems
>   to me that this overhead can be disregarded as influential but, if

depends how kmuch packets are actually gathered. if you tcpdump everything 
from loaded gigabit link it won't be small. you will have to use at least 
2-disk stripping to be able to write data ;)


i don't know if it's "official" docs, just generate some traffic, observe 
how much CPU is idle, then add tcpdump to the mix and do the math.

simple