Re: HUGE packet-drop

[Luca Bruno <lucab () debian org>]

Guy Harris scrisse:

> You need at least libpcap 1.0.0 to have tpacket ("turbo-packet",
> right?) support in the standard libpcap.  You could also get it with
> the Phil Wood patches he mentioned, although that only supports
> memory-mapped access on Linux, not FreeBSD - but he's using Linux, so
> that doesn't apply (well, unless it's Debian GNU/kFreeBSD or whatever
> they're calling it :-)).
>
> I see code for tpacket support in the 2.4.20 source (two dot four dot
> twenty, not two dot six dot anything); I think it dates back before
> then (perhaps 2.4.0).  It requires CONFIG_PACKET_MMAP.
>
> I don't know whether any of the kernel configuration stuff shipped
> with the kernel has a notion of defaults or not; perhaps the default
> changed in 2.6.27, so that you got tpacket support unless you
> explicitly configured it *out* of the kernel, rather than not getting
> it unless you explicitly configured it *into* the kernel.  However, I
> think distributions can choose their own defaults, so perhaps Debian
> changed the default at some point.

I can't speak for Lenny, but it looks like Squeeze (which was released
a couple of days ago) has both:
* http://packages.debian.org/squeeze/libpcap0.8
* http://merkel.debian.org/~jurij/2.6.32-30/amd64/

You may want to try there, adding patches and sysctl on top of it.

Cheers, Luca

-- 
 .''`.  ** Debian GNU/Linux **  | Luca Bruno (kaeso)
: :'  :   The Universal O.S.    | lucab (AT) debian.org
`. `'`                          | GPG Key ID: 3BFB9FB3
  `-     http://www.debian.org  | Debian GNU/Linux Developer

Attachment: signature.asc
Description: