Re: pcap_dispatch on linux 2.6 with libpcap 1.1.1

[Jim Lloyd <jlloyd () silvertailsystems com>]

On Wed, Aug 25, 2010 at 2:14 AM, Guy Harris <guy () alum mit edu> wrote:

> On Aug 23, 2010, at 3:54 PM, Jim Lloyd wrote:
>
> > What is the relationship between the socket receive buffer and the
> > mmap buffer? Does the mmap buffer replace the socket receive buffer,
>
> Yes.

Cool.


> > I currently have my primary testing
> > machine configured with
> >
> > net.core.rmem_default = 4194304
> > net.core.rmem_max = 16777216
> >
> > Do we expect the rmem_default setting to be significant or not?
>
> No.

Yay!


> > Can you recommend any
> > traffic generators that can provide test traffic with SACKs?
>
> Unfortunately, no.  (That doesn't mean they don't exist, it just means I
> don't know what traffic generators are out there, or which of them provide
> test traffic with SACKs.)

Ok, thanks anyway.  FYI I was able to generate some SACKs by sending my test
traffic through an open http proxy. I expect the SACKs I generated don't
really cover all possible scenarios, but at least I have raised confidence
now that we can handle the most common cases.


> > Is there any way to detect these kinds of drops with Linux? It looks like
> > the receive drops column in /proc/net/dev might be this count. Can you
> > confirm?
>
> I was mistaken - on Linux, at least in libpcap 1.1.x, if you're capturing
> in promiscuous mode, libpcap *does* fetch the drop count from /proc/net/dev
> and put it into the ps_ifdrop field of the result of pcap_stats().  I don't
> know why that's restricted to promiscuous mode.

That works for me!

Thanks Guy, these answers have been very helpful.

-Jim
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.