mmap-ed tcpdump and gigabit ethernet

["Dmitry Rubinstein" <Dmitry.Rubinstein () bhive net>]

Greetings, all!
 
I would like to have an efficient capturing solution for a gigabit
network. It seems as if Phil Wood's libpcap should do the work. However,
I am not sure as for its support for the jumbo frames. When in MMAP
mode, this version of tcpdump doesn't seem to cope with -s 0 or -s N for
N >> 4000 (terminating with Error: setsockopt(PACKET_RX_RING): Invalid
argument \n tcpdump: malloc: Illegal seek), whereas in the NORMAL mode I
can see frames as large as 9000 bytes (and more). Anyone has had this
problem (and solved it)?
 
Thanks!
 
--
Sailing: The fine art of getting wet and becoming ill while slowly going
nowhere at great expense.       
 
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.