Re: HUGE packet-drop

[Jesper Dangaard Brouer <hawk () comx dk>]

M. V. <bored_to_death85 <at> yahoo.com> writes:

> so, i dont know what else to do, seems like nothing works for me :-S
> 1) does anyone have any other suggestions that may help?
> 2) about MMAP support in Debian kernel: i installed Debian5.0.3 from original 
> ISO file. does anyone know if MMAP exists in its kernel by default? how can i 
> get sure about that?

The easiest way to see if you are using the MMAPed version is to look in:
 /proc/net/ptype

Your are using the MMAP version if the Function "tpacket_rcv" is listed (while
you perform a tcpdump). Notice the "t" in front of "packet_rcv", if the "t" is
missing, then you are using the old/normal version.

If I remember correctly, you need at least libpcap 1.0.0 to have
MMAP/tpacket_rcv support.

And I think that if you compile libpcap on a Debian 5.0/lenny, you will not get
MMAP support, because this Debian has to old version of the kernel headers. 
AFAICR, MMAP support got added in kernel 2.6.27 and Debian lenny runs 2.6.26.

Cheers,
--
Best regards
  Jesper Brouer
  ComX Networks A/S
  Linux Network Kernel Developer
  Cand. Scient Datalog / MSc.CS
  Author of http://adsl-optimizer.dk
  LinkedIn: http://www.linkedin.com/in/brouer


-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.