Re: [PATCH] Re: Bug: Counting dropped packets in linux

[Guy Harris <guy () alum mit edu>]

On Aug 28, 2009, at 1:24 PM, Dustin Spicuzza wrote:

> Dustin Spicuzza wrote:
>
> > So after reading the libpcap and kernel source, I see that this is
> > actually how its supposed to work. But it *seems* like it would be  
> > quite
> > nice if we could grab the interface driver drop statistics as well as
> > drops resulting from the capture buffer filling up.
> >
> > I'm looking for a way to query the kernel about this number --  
> > should I
> > bother submitting a patch if I can get it, or is the current behavior
> > more desired?
>
> It appears that the only way to get this number is by looking at
> /proc/stats/dev, so I added something that can parse it for the  
> correct
> interface, and get the drop stats from there. Since those are  
> cumulative
> over the boot time of the system, it stores a number and does
> incremental updates of the number. It doesn't do this when not in
> promiscuous mode however, since that doesn't make any sense.
>
> It works for me, let me know what you think.

I think that

> +               handle->md.stat.ps_drop += (handle->md.proc_dropped - if_dropped);

and

> +       stats->ps_drop = handle->md.stat.ps_drop;

are wrong, because ps_drop is supposed to reflect the number of  
packets dropped by the packet capture mechanism because they arrived  
faster than the app could consume them, but not the number of packets  
dropped by the adapter or adapter driver before they even made it to  
the capture mechanism.  ps_ifdrop is for the latter (and the comment  
about it being unimplemented is false on Tru64 UNIX, for example, so  
don't let that comment scare you off).
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.