[Libpcap] Linux ps_drop()

[Jon Schipp <jonschipp () gmail com>]

Hello Guy, all,

I'm going through some past mailing lists posts and I found this, which may
have answered my question on where libpcap on Linux gets its drop count:
http://seclists.org/tcpdump/2010/q3/46

"You have a recent version of libpcap, and a recent kernel, so pcap_stats()
should be getting the dropped-packet statistics by calling
getsockopt(PF_PACKET socket, SOL_PACKET, PACKET_STATISTICS, &statistics
buffer, ...). The PF_PACKET socket code should increment the count of
dropped packets any time it fails to put a packet into the buffer because
the buffer is full."

Is this still true?

- Jon
-- 
------------------------------------------------------------------

VMB: 812-682-0231

Dubois County Linux User Group - http://www.dclinux.org
Southern Indiana Computer Klub - http://sickbits.networklabs.org
Bloomington FOOLS - http://www.bloomingtonfools.org/
BloomingLabs -  http://www.bloominglabs.org
ISSA-Kentuckiana  -  http://issa-kentuckiana.org

GPG Key ID: 810903CB
Key fingerprint = 0069 ED69 EABB DF84 5983  AD3C 6C20 BEFD 8109 03CB
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.