[tcpdump-workers] How tcpdump determines the "dropped by kernel"?

2013-11-24 Thread Eliezer Croitoru
I have been reading the man pages of tcpdump and I am not sure if my OS will report the relevant info. Since I would not like to research tcpdump code I would like to get some help about it from others. So my kernel would declare on packets that was dropped but still the connection was OK an

Re: [tcpdump-workers] How tcpdump determines the "dropped by kernel"?

2013-11-25 Thread Eliezer Croitoru
o use more ram for these buffers can be an option. Thanks, Eliezer On 25/11/13 20:07, Guy Harris wrote: On Nov 24, 2013, at 5:04 PM, Eliezer Croitoru wrote: Since I would not like to research tcpdump code I would like to get some help about it from others. So my kernel would declare on pa

Re: [tcpdump-workers] How tcpdump determines the "dropped by kernel"?

2013-11-25 Thread Eliezer Croitoru
Hey, Yes in high load it can cause some troubles. The solution I could think about was a dedicated machine that would receive all traffic from the replication(HUB-like) port while the machine Ethernet is on promiscuous mode which will then capture all traffic from the network. I do not know

Re: [tcpdump-workers] How tcpdump determines the "dropped by kernel"?

2013-11-25 Thread Eliezer Croitoru
Ho ok. On 25/11/13 21:28, Guy Harris wrote: On Nov 25, 2013, at 11:01 AM, Eliezer Croitoru wrote: >I am running Linux on couple systems: Gentoo, Ubuntu 10.04+newers, CentOS. What kernel version? I have one 2.6.32-X in the CentOS. Ubuntu has 3.2+ kernels(3.2,3.4,3.7..) Gentoo is anot