Re: Recording slow scans

[Vern Paxson <vern () ee lbl gov>]

Just a tweak, to avoid a misimpression:

> Lots of folks use tcpdump. Depending on the platform you're
> running it on, take its results with a grain or 2 of salt.
> We've observed on busy networks that tcpdump reports zero
> packets lost - but network analyzers and NFRs see more traffic
> than tcpdump did. Hmmmm.... :)  Just an FYI. Solaris was
> particularly not so hot in this regard.

This isn't tcpdump at fault here, but instead the local packet filter.
tcpdump just uses whatever libpcap provides it.  I didn't want folks
to get the impression that there's something flaky about tcpdump in
general.

For those interested, there's a chapter in my thesis that details
a variety of packet filter horror stories:

        ftp://ftp.ee.lbl.gov/papers/vp-thesis/filter.ps.gz
        ftp://ftp.ee.lbl.gov/papers/vp-thesis/filter.pdf

- Vern