[tcpdump-workers] capturing vlan traffic on linux

2008-01-23 Thread Aaron Turner
Box is Linux 2.6.12 kernel tcpdump 3.8 libpcap 0.8.3 Intel e1000 NIC Long story short, 1) when sniffing on the vlan tagged interface (eth0.5), I can see inbound and outbound traffic, but the ethernet frames are not tagged. 2) when sniffing on the physical interface (eth0) I can see only one direc

Re: [tcpdump-workers] Secret of great tcpdump performance ..

2008-01-23 Thread Rick Jones
Michael Krueger wrote: On Tue, 22 Jan 2008 19:47:24 +0100, Rick Jones <[EMAIL PROTECTED]> wrote: How many processors do you have, are interrupts from each NIC going to seperate processors/cores/whatever (show us the output of /proc/interrupts), and have you bound each tcpdump to its corresp

Re: [tcpdump-workers] Secret of great tcpdump performance ..

2008-01-23 Thread Rick Jones
Michael Krueger wrote: On Tue, 22 Jan 2008 19:47:24 +0100, Rick Jones <[EMAIL PROTECTED]> wrote: How many processors do you have, are interrupts from each NIC going to seperate processors/cores/whatever (show us the output of /proc/interrupts), and have you bound each tcpdump to its corresp

Re: [tcpdump-workers] Secret of great tcpdump performance ..

2008-01-23 Thread Michael Krueger
On Tue, 22 Jan 2008 19:47:24 +0100, Rick Jones <[EMAIL PROTECTED]> wrote: How many processors do you have, are interrupts from each NIC going to seperate processors/cores/whatever (show us the output of /proc/interrupts), and have you bound each tcpdump to its corresponding NICs interrupt C

Re: [tcpdump-workers] Secret of great tcpdump performance ..

2008-01-23 Thread Michael Krueger
On Tue, 22 Jan 2008 19:47:24 +0100, Rick Jones <[EMAIL PROTECTED]> wrote: How many processors do you have, are interrupts from each NIC going to seperate processors/cores/whatever (show us the output of /proc/interrupts), and have you bound each tcpdump to its corresponding NICs interrupt C