Emre Bastuz wrote on Thursday, February 12, 2004 3:43 PMThis is also fixed in more current libpcap version, however that has not been ported to the tree.
Hi,
for sniffing purposes I have a FreeBSD 4.9-STABLE box running on highend, state-of-the-art hardware (Xeon something) with all bells and whistles.
The NICīs an onboard copper em0 with gig-e capabilities.
Nevertheless I am getting massive packet drops (40%-60%) when I start sniffing a gigabit ehthernet segment although the CPU load is very low.
After doing some research in in the appropriate mailing list
archives I found
out that there are (or were?) sometimes issues with the libpcap.
As there was a
more current one in the ports collection (0.8.1 as opposed to 0.7
in the base
system) I used this instead (with LIBPCAP_OVERWRITE_BASE=yes) but
still I am
losing the same amount of packets when doing a tcpdump.
I don't know what libpcap in ports does regarding the size of the packet capture read buffer, but I've modified the stock libpcap's pcap-bpf.c so it offers to use a buffer much larger than 32768 bytes (look for the loop that has the line
for (v = 32768; v != 0; v >>= 1) {
and increase 32768 to something more reasonable (say, 1048576).
I've also set the debug.bpf_bufsize and debug.bpf_maxbufsize sysctls to match the number in pcap-bpf.c.
Pete
_______________________________________________ [EMAIL PROTECTED] mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-net To unsubscribe, send any mail to "[EMAIL PROTECTED]"
