Re: [PATCH] Re: Bug: Counting dropped packets in

[Guy Harris <guy () alum mit edu>]

On Aug 30, 2009, at 8:26 PM, Stephen Donnelly wrote:

> The current 'drop' count in libpcap is not intuitive, and frequently  
> arguably undercounts since it does not include 'rx buffer overflow'  
> and similar interface/OS specific packet loss. OTOH, the  
> documentation is quite clear about what it does count I think.
>
> I would not recommend changing the definition or Linux  
> implementation at this point. It would change the behaviour for  
> existing applications and would only cause further confusion.

Counting interface drops in ps_drop would definitely be wrong, because  
it doesn't do so on other platforms, and there's already a ps_ifdrop  
field to count interface drops.

> I think the current libpcap statistics interface is not very useful  
> because it is underspecified and varies too much between platforms.  
> Hopefully for pcap-ng (the portable packet capture library, not the  
> file format) we can get a better live statistics interface which is  
> more tightly defined and can conserve meaning across platforms.

We should add to libpcap an API that supplies a pcap-ng Interface  
Statistics Block, so that

	1) it can supply only those statistics that are available on the  
platform in question, explicitly indicating which ones it's supplying;

	2) the set of statistics it supplies can be extended (so we don't  
have to anticipate, when we initially design the API, all possible  
packet statistics that could ever be obtained from any current or  
future platform and that an application would want);

	3) we don't end up with two *separate* ways of doing that, requiring  
that a "libpcap interface statistics block" be translated to a "PCAP- 
NG Interface Statistics Block" before being written to a file.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.