On Thu, May 01, 2008 at 02:00:40PM -0700, Joe S wrote:
> On Wed, Apr 30, 2008 at 10:29 AM, Paolo Di Francesco
> <[EMAIL PROTECTED]> wrote:
>
> > 10601 packets received by filter
> > 9632 packets dropped by kernel
>
> This looks like something tcpdump would say. Given the load of device
> and low cpu power, tcpdump is very likely to drop packets when trying
> to print them out to the console.
It's the kernel dropping packets at the pushing end, because tcpdump
cannot process the quick enough at the pulling end. Note that tcpdump
talks about pcap packets, which are copies of the originals being
captured. These stats say nothing about the actual network packets
being dropped or not.
A way to speed up packet capture by tcpdump so less pcap packets are
droppped is to write to a pcap file using the -w option. Anithe way is
to use a more strict filter.
-Otto
