tcpdump mailing list archives
Re: dealing with collisions, dropped packets
From: Aaron Turner <aturner () pobox com>
Date: Mon, 1 Nov 2004 12:19:48 -0800
A few comments: 1) I doubt that collisions are the cause. A collision will actually prevent tcpdump from seeing the packet and reduce the throughput of the network, thus tcpdump should drop fewer packets. 2) You can check the number of collisions on most Unix/Linux boxes using ifconfig. You'll see a collisions counter which will increment over time. Other errors and statistics are also available. Regards, Aaron On Mon, Nov 01, 2004 at 03:01:46PM -0500, Matt Van Mater wrote:
Hi all, Recently I've been investigating why tcpdump on my IDS shows quite a few packets as being dropped. I think this is because my traffic to the IDS is fed through a hub where I know there are many collisions (there may be too many packets per second for the little soho 10/100 hub to handle). I'm not sure how tcpdump handles collisions, and so I don't know if this is even a problem or not. Is there a way to get more fine grained statistics on why packets are dropped, and would collisions coming in off a hub be shown as dropped? I'm seeing a traffic feed of roughly 4000-5000 packets per second and about 1000 collisions per minute, so I don't think that the rate of traffic is the cause of my problem. If the dropped packets being displayed are just the collisions from the hub then it's no big deal, but if it's something else I'd like to try and fix it of course. Thanks, Matt - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
-- Aaron Turner <aturner at pobox.com|synfin.net> http://synfin.net/ They that can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. -- Benjamin Franklin All emails are PGP signed; a lack of a signature indicates a forgery.
Attachment:
signature.asc
Description: Digital signature
Current thread:
- dealing with collisions, dropped packets Matt Van Mater (Nov 01)
- Re: dealing with collisions, dropped packets Guy Harris (Nov 01)
- Re: dealing with collisions, dropped packets Aaron Turner (Nov 01)
- Re: dealing with collisions, dropped packets Michael Richardson (Nov 01)
- Re: dealing with collisions, dropped packets sthaug (Nov 01)
- Re: dealing with collisions, dropped packets Michael Richardson (Nov 01)
- <Possible follow-ups>
- Re: dealing with collisions, dropped packets Matt Van Mater (Nov 03)
- Re: dealing with collisions, dropped packets sthaug (Nov 03)
- Re: dealing with collisions, dropped packets Guy Harris (Nov 04)
- Re: dealing with collisions, dropped packets sthaug (Nov 03)