Re: [Patch] tcpdump probabilistic sampling

[Jesse Kempf <jkempf () davisvision com>]

On Apr 2, 2008, at 6:41 AM, Bruce M Simpson wrote:
> Jesse Kempf wrote:
> > Hi,
> > So tcpdump tends to jam up the terminal a bit when you try to dump  
> > on a saturated gigabit link. I've added a -P option to tcpdump  
> > that lets you specify a probability for tcpdump to print each  
> > packet. It uses drand48() to figure out whether each packet  
> > captured should be printed. Obviously this isn't the same thing as  
> > saying "print every Nth packet" since this is a Bernoulli process  
> > and the expected value of the number of printed packets is different.
> >
> > Also, I hacked up the print_packet function, so this only works  
> > for parse and print mode.
>
> Somebody, I can't remember who, has patches to bpf which push the  
> probability to the capture layer itself, rather than just the  
> printing routine. They were actively using this for NIDS stuff.
>
> The thing which got in the way of adoption was a lack of versioning  
> of bpf capabilities IIRC. Not sure if this got solved or not.

It does make quite a bit of sense to do it that way, and is arguably  
the Right Way to do it. Of course there's the matter of getting it  
pushed out to world + dog.

Cheers,
-Jesse Kempf



------------------------------------------------------------------------
The information contained in this communication is intended
only for the use of the recipient(s) named above. It may
contain information that is privileged or confidential, and
may be protected by State and/or Federal Regulations. If
the reader of this message is not the intended recipient,
you are hereby notified that any dissemination,
distribution, or copying of this communication, or any of
its contents, is strictly prohibited. If you have received
this communication in error, please return it to the sender
immediately and delete the original message and any copy
of it from your computer system. If you have any questions
concerning this message, please contact the sender.
------------------------------------------------------------------------

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.