Re: [tcpdump-workers] Best OS / Distribution for gigabit capture?

2011-02-07 Thread Darren Reed
On 5/02/11 11:20 PM, M. V. wrote: hi, as i mentioned in my previous mail, (with the title: "HUGE packet-drop") i'm having problem trying to dump gigabit traffic on harddisk with tcpdump on Debian5.0. i tried almost everything but got no success. so, i decided to start-over: *) if anyone has ex

Re: [tcpdump-workers] Best OS / Distribution for gigabit capture?

2011-02-07 Thread Rick Jones
Fabian Schneider wrote: Hi, Regarding the OS we have done testing on this some five years ago. Back then we found that FreeBSD performed better than Linux. Yet there have been improvements proposed for both Linux (memory mapping, and Luca Deri's work) and FreeBSD ("zero-copy BPF and Alexandre Fi

Re: [tcpdump-workers] HUGE packet-drop

2011-02-07 Thread rixed
I've been using Squeeze libpcap (ie. 1.1.1) to capture some traffic from a gigabit ethernet adapter today, connected straight to another gigabit adapter of another host that was sending a pcap file with tcpreplay. receive buffer was resized up to 60Mb (with proper rmem_max). And I also experienced

Re: [tcpdump-workers] Request for new DLT value for Wireshark Dissector

2011-02-07 Thread Schemmel , Hans-Christoph
Guy Harris alum.mit.edu> writes: > should I just describe the holes as "other data", so you're not > constrained to forever make them all be AT command/response text, or is it guaranteed (now and forever) to > be AT-command-or-response text?- The description of the holes as "other data" sounds

Re: [tcpdump-workers] HUGE packet-drop

2011-02-07 Thread M. V.
thank you all for your comments, > I see code for tpacket support in the 2.4.20 source (two dot four dot twenty, >not two dot six dot anything); > I think it dates back before then (perhaps 2.4.0). It requires >CONFIG_PACKET_MMAP. i checked inside "/proc/net/ptype" on 2.6.26 while running tcp

Re: [tcpdump-workers] Best OS / Distribution for gigabit capture?

2011-02-07 Thread Fabian Schneider
Hi, Regarding the OS we have done testing on this some five years ago. Back then we found that FreeBSD performed better than Linux. Yet there have been improvements proposed for both Linux (memory mapping, and Luca Deri's work) and FreeBSD ("zero-copy BPF and Alexandre Fiveg's work). To get det