Re: questions on -B, performance, mbufs, and

[Guy Harris <guy () alum mit edu>]

On Sep 27, 2011, at 7:32 PM, Jon Schipp wrote:

> Is this specific to Linux, because I haven't experienced this on FreeBSD?

It's specific to the platforms on which libpcap implements it; currently, Linux is one such platform, as is Tru64 UNIX, 
but FreeBSD (and other *BSDs and Mac OS X) aren't.

> Is this Ubuntu distro addendum or has this been added by the tcpdump team.

It was added by somebody who sent a patch for it to the tcpdump/libpcap team.  (The code that implements it is in 
libpcap; tcpdump just has code that, on all platforms, prints the number if it's non-zero.  It's always zero on 
platforms where it's not implemented.)

> Where do the numbers come from for the "dropped by interface",

On Linux, they come from /proc/net/dev - libpcap scans that looking for a packet drop count from the interface, and 
reports how that number differs from the last time it read it (either when it started the capture or when it was last 
asked for the statistics in a pcap_stats() call).

> I was just wondering how this differs. Would this be the number reported by
> ifconfig?

I don't know how ifconfig gets the number it reports, so I don't know whether that would be what ifconfig reports.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.