tcpdump mailing list archives
Re: percentage of traffic captured on monitor interfaces
From: Mike Kershaw <dragorn () kismetwireless net>
Date: Sat, 17 Dec 2011 19:48:30 -0500
abhinav narain <abhinavnarain10 () gmail com> wrote: I wanted to know how much percentage of the original wireless traffic do I lose when I am sniffing on monitor interfaces ? pcap statistics show me no packet loss, but I wanted to know, if the virtual interfaces( phy{0,1}) itself gave me all the traffic or not. Ideal case would have been sweeping out the packets from the kernel itself, but my patch does not work for some reason, hence I am sniffing on monitor interfaces. Abhinav - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe. Unless your sniffing hw is vastly underpowered or your code is seriously inefficient, you should see 100% of the traffic visible to your sniffing device. What percentage of the packets in the air that constitutes is unknowable unless you control all transmitters and can correlate. Packet loss in the air can happen due to localized interference, reflection, multipath fade, and crummy drivers. A transmitter in range of the sniffer can cause interference not necessarily visible to the original transmitter and receivers. -- Sent from mobile, brevity, accuracy and security disclaimers. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- percentage of traffic captured on monitor interfaces abhinav narain (Dec 17)
- Re: percentage of traffic captured on monitor interfaces Mike Kershaw (Dec 17)