Re: BPF problems on FreeBSD 7.0

2008-07-15 Thread Robin Sommer
On Tue, Jul 15, 2008 at 14:25 -0700, you wrote: >> Thanks for the suggestion. Here's the netstat -B output at the time >> it has stalled (after about 6 hours of working normally): [...] > at your rate of receiving packets, it passed that value about > 2 minutes before this snapshot was taken.. S

Re: BPF problems on FreeBSD 7.0

2008-07-15 Thread Julian Elischer
Robin Sommer wrote: On Mon, Jul 14, 2008 at 14:44 +0100, Bruce M. Simpson wrote: One place to start might be: netstat -B output in 7.x (I *think* this got MFCed), this will let us see what the drop count is for the Bro process, and what the flags are for the open BPF descriptors in the system.

Re: BPF problems on FreeBSD 7.0

2008-07-15 Thread Robin Sommer
On Mon, Jul 14, 2008 at 14:44 +0100, Bruce M. Simpson wrote: > One place to start might be: netstat -B output in 7.x (I *think* this got > MFCed), this will let us see what the drop count is for the Bro process, > and what the flags are for the open BPF descriptors in the system. Thanks for th

Re: BPF problems on FreeBSD 7.0

2008-07-14 Thread Bruce M. Simpson
Robin Sommer wrote: Hi all, we're seeing some strange effects with our libpcap-based application (the Bro network intrusion detection system) on a FreeBSD 7-RELEASE system. As the application has always been running fine on 6.x, we're wondering whether this might be triggered by any of the chang

BPF problems on FreeBSD 7.0

2008-07-11 Thread Robin Sommer
Hi all, we're seeing some strange effects with our libpcap-based application (the Bro network intrusion detection system) on a FreeBSD 7-RELEASE system. As the application has always been running fine on 6.x, we're wondering whether this might be triggered by any of the changes that went into 7.