Subject: RE: Monitoring and reporting network usage - dropped packets

From: Sean Kelly <[email-masked]>
Date: Tue, 17 Jul 2001 16:27:14 +0100

Hi there,

	Sorry to drag up my old thread *again*, but I have just installed my new 3com 905B card and still seem to get poor capture performance.

	With reference to the following snippet:

> -----Original Message-----
> From: Peter Van Epp
> Subject: Re: Monitoring and reporting network usage - dropped packets
> 
> 
> 	Yep, the bpf buffer (between the kernel and libpcap) is 
> overwriting around %50 of the packets offered to it. You
> need to boost the bpf buffer size and/or get a faster machine.
> You will find the counter it is referring to in /sys/net/bpf.c
> in the kernel. When the application (libpcap on behalf
> of tcpdump in this instance) doesn't read the buffer fast 
> enough from the user side it will overwrite the buffer with
> the new data and update the lost packets counter.

/sys/net/bpf.c has contains:

#if BSD < 199103
...SNIP SNIP...
#else
#define BPF_BUFSIZE 4096
#define UIOMOVE(cp, len, code, uio) uiomove(cp, len, uio)
#endif

so am I correct in assuming that my BPF buffer size is 4K?  If so, shouldn't I be increasing this?  I remember Peter mentioning that the standard size is 8K and this really should be 32K for packet capture...

	Also, am I referring to the correct buffer?  I seem to remember there is also pcap-bpf.c in the PCAP source - should I increase this too?

	Thanks,

--
Sean Kelly

==========================================
Save up to ONE HUNDRED POUNDS on ADSL!
See http://www.adsl-now.co.uk/ for details
Offers valid during July 2001
==========================================

*************************************************************
This email message has been scanned by MIMEsweeper for the 
presence of computer viruses by www.viruscleaningcentre.co.uk 
Hosted by the North East Datacentre www.ne-datacentre.co.uk
*************************************************************