Re: [tcpdump-workers]tcpdum lose packets

["Aaron Turner" <synfinatic () gmail com>]

On Mon, Jan 12, 2009 at 11:09 PM,  <liu.yongfeng () zte com cn> wrote:
> I use tcpdump to capture the packets of one RTP stream  in my rtsp
> server,by the RTP sequence number,i found some packets had lost.
> but in the client that conneted to this server in the same time ,use
> tcpdump capture the packets of this RTP stream,i do not found
> lost packet.i don't konw why? someone can give me a reason about this
> problem

Many reasons are possible, but most are generalized to "the packets
are being sent faster then tcpdump can read them from the network card
and write them to disk".  Specifically, but not limited to:

- Crappy network card
- Crappy network card driver
- Kernel networking buffers are too small
- Slow/overloaded PCI bus
- Slow/overloaded disk(s)
- Slow/overloaded CPU
- You're using a switch SPAN port and the switch dropped frames
- You're sniffing a 1Gbps network with a 10/100Mbps NIC
- Some of the frames are Jumbo frames and your NIC doesn't support them

Again, this isn't a complete list, but gives you some things to look into.

-- 
Aaron Turner
http://synfin.net/
http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows
They that can give up essential liberty to obtain a little temporary
safety deserve neither liberty nor safety.  -- Benjamin Franklin
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.