Re: dealing with collisions, dropped packets

["Matt Van Mater" <nutter_ () hotmail com>]

sorry for the late replies, and thanks for the comments.

> I sense some fundamental misunderstandings here. Basically:

> A collision on half duplex media (such as a hub) is a *normal* and
> *expected* occurence, and does *not* cause a packet to be dropped.

> Note that this does not apply to "late collisions" which are quite
> different - late collisions are signs of *error* (for instance a
> duplex mismatch).

Sorry I did not make myself clear.  I know very well that collisions on hubs 
are normal.  What I wasn't sure of was if tcpdump was seeing the first 
transmission of a packet, and then dropping the second copy of the packet 
when it is recent by the originating host so as not to skew statistics or 
something.

And I have checked, this is not a duplex mismatch, the switch sending the 
hub packets is set to autosense and has correctly set the outgoing switch 
port to half duplex (send only).

> 1000 collisions per minute with 4000-5000 pps is a very *low* collision
> rate.

I know, thats what I thought, but i wanted to mention that because I thought 
perhaps the collisions were the source of my dropped packets since the 
numbers are usually fairly close.  (ie if i count dropped packets vs 
retransmits due to collision on the switch they are pretty close)

> I expect your dropped packets are due to something else. But you should
> definitely check for late collisions.

i've tried the autosensing\duplex\half duplex and replaced cables and get 
the same behavior in all these scenarios.  I know the machine can handle it, 
it's definitely not a hardware limitation.  It is a ns2100 from sourcefire 
and has all the goodies, intel gig ethernet, lots of cpu ram and scsi 
hd's...

I'm going to try running the bulk of the traffic directly from the switch 
SPAN port to the ids rather than through the hub to see if i still have the 
same packet drop rate.

Matt


-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.