Date: Fri, 13 Feb 2004 00:47:55 +0200 From: Petri Helenius <pete@he.iki.fi> To: Guy Helmer <ghelmer@palisadesys.com> Cc: Emre Bastuz <info@emre.de> Subject: Re: 4.9-STABLE heavily dropping packets? libpcap issue? Message-ID: <402C029B.30103@he.iki.fi> In-Reply-To: <FPEBKMIFGFHCGLLKBLMMMENNCDAA.ghelmer@palisadesys.com> References: <FPEBKMIFGFHCGLLKBLMMMENNCDAA.ghelmer@palisadesys.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Guy Helmer wrote:
>Emre Bastuz wrote on Thursday, February 12, 2004 3:43 PM
>
>
>>Hi,
>>
>>for sniffing purposes I have a FreeBSD 4.9-STABLE box running on highend,
>>state-of-the-art hardware (Xeon something) with all bells and whistles.
>>
>>The NICīs an onboard copper em0 with gig-e capabilities.
>>
>>Nevertheless I am getting massive packet drops (40%-60%) when I
>>start sniffing a
>>gigabit ehthernet segment although the CPU load is very low.
>>
>>After doing some research in in the appropriate mailing list
>>archives I found
>>out that there are (or were?) sometimes issues with the libpcap.
>>As there was a
>>more current one in the ports collection (0.8.1 as opposed to 0.7
>>in the base
>>system) I used this instead (with LIBPCAP_OVERWRITE_BASE=yes) but
>>still I am
>>losing the same amount of packets when doing a tcpdump.
>>
>>
>
>I don't know what libpcap in ports does regarding the size of the packet
>capture read buffer, but I've modified the stock libpcap's pcap-bpf.c so it
>offers to use a buffer much larger than 32768 bytes (look for the loop that
>has the line
>
> for (v = 32768; v != 0; v >>= 1) {
>
>and increase 32768 to something more reasonable (say, 1048576).
>
>I've also set the debug.bpf_bufsize and debug.bpf_maxbufsize sysctls to
>match the number in pcap-bpf.c.
>
>
>
This is also fixed in more current libpcap version, however that has not
been ported to the tree.
Pete
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?402C029B.30103>