tcpdump mailing list archives

questions perf about tcpdump->libpcap->freebsd

From: rmkml <rmkml () wanadoo fr>
Date: Wed, 18 Dec 2002 02:59:17 +0100

Hello,

When I use tcpdump/libpcap (371/071) on my freebsd box,

I don't drop (kernel) packet on 100Mb network.

(My test 100Mb network is bench iperf v1.6.3)


But when I use tcpump/snort/prelude/ntop on my freebsd box,

I drop (kernel) packet on 20Mb network !


ok, if use only tcpdump and snort (or tcpdump/ntop or snort/prelude etc...)
only two client libpcap, I don't drop packet on 80Mb network.


Im tuned kernel 4.7,
large bufer used ...
but always drop packets !
(debug.bpf_bufsize=512K,
kern.ipc.maxsockbuf=4M,
net.inet.ip.intr_queue_maxlen=500,
kern.ipc.somaxconn=4k.......)

I reduce mtu on my process (tcpdump/snort/prelude).
but always drop packets !

Could you explain me please ?

How fix/change this ? (windows rotate buffer ?)

I have Athlon XP 1800+,
change this ? (up)

Thanks for answers.

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe

Current thread:

understanding filtering Sam Carleton (Dec 16)
- Re: understanding filtering Guy Harris (Dec 16)
  - Re: understanding filtering Andrew Brown (Dec 17)
  - Re: understanding filtering George Bakos (Dec 17)
  - releases (was Re: understanding filtering ) Michael Richardson (Dec 17)
    - Re: releases (was Re: understanding filtering ) Guy Harris (Dec 17)
- questions perf about tcpdump->libpcap->freebsd rmkml (Dec 17)