Working on an IDS product using libpcap, I stumbled upon a problem with packet loss statistics: libpcap would report as dropped at the interface level packets that were actually seen by the product. Because of that, I noticed it used the rx_dropped stat from /proc/net/dev, which is wrong, as it counts layer 2+ drops. The straightforward solution is to use rx_missed_errors + rx_fifo_errors from sysfs. However, there are many drivers not implementing this interface, and accounting loss directly on rx_dropped. I believe (any pointers for this would be super useful) ethtool provides the means to query if this stat is supported by the device driver. On the other hand, it would make sense for the drivers to implement this counter anyway. If this happens, then it can be considered a safe bet for libpcap to just look at these counters without the extra code talking to ethtool. I intend to update these remaining drivers gradually. Sadly, I don't have the hardware for each and every device. So, is there any way to distribute the testing? Alternatively, could the change be considered trivial and only be build-tested (as well as the static analysis tools provided by the usual toolchain). An example of what I expect the changes to look like is this: https://github.com/torvalds/linux/commit/ecf7130b087a9bd1b9d03dbf452630243210d22e
Besides this, are these kind of changes likely to make it to LTS kernels? Likewise, I'd like to make an attempt for my changes on libpcap to be compatible with the oldest supported kernels. Regards and thanks for your time, Mario.
