Re: [tcpdump-workers] questions on -B, performance, mbufs, and

2011-09-28 Thread Rick Jones
On 09/28/2011 03:57 PM, Sanjay Sundaresan wrote: What is the meaning of dropped by interface ? Dropped by kernel means packets dropped due to lack of memory at the kernel in the same way what does interface drop signifies ? If the numbers for dropped by interface correlate with the packet drops

Re: [tcpdump-workers] questions on -B, performance, mbufs, and

2011-09-28 Thread Sanjay Sundaresan
What is the meaning of dropped by interface ? Dropped by kernel means packets dropped due to lack of memory at the kernel in the same way what does interface drop signifies ? -Original Message- From: tcpdump-workers-ow...@lists.tcpdump.org [mailto:tcpdump-workers-ow...@lists.tcpdump.org] O

Re: [tcpdump-workers] Understanding particular tcpdump log

2011-09-28 Thread Guy Harris
On Sep 28, 2011, at 2:28 AM, Srikanth Raju wrote: > In one of my tcpdump logs, I have the following two lines which is the same > packet. > > 00:43:44.896482 P 00:00:ac:12:80:01 ethertype IPv4 (0x0800), length 76: > 172.18.128.1.ssh > 155.xx.xx.xx.56365: S 1308033114:1308033114(0) ack > 131

Re: [tcpdump-workers] questions on -B, performance, mbufs, and

2011-09-28 Thread Guy Harris
On Sep 27, 2011, at 7:32 PM, Jon Schipp wrote: > Is this specific to Linux, because I haven't experienced this on FreeBSD? It's specific to the platforms on which libpcap implements it; currently, Linux is one such platform, as is Tru64 UNIX, but FreeBSD (and other *BSDs and Mac OS X) aren't.

Re: [tcpdump-workers] questions on -B, performance, mbufs, and

2011-09-28 Thread Rick Jones
On 09/27/2011 07:32 PM, Jon Schipp wrote: Hello Guy, I'm now doing testing with tcpdump on an Ubuntu machine. One difference I noticed was that in addition to "dropped by kernel", tcpdump on Ubuntu also reports "dropped by interface". Is this specific to Linux, because I haven't experienced th

[tcpdump-workers] Understanding particular tcpdump log

2011-09-28 Thread Srikanth Raju
Hi, In one of my tcpdump logs, I have the following two lines which is the same packet. 00:43:44.896482 P 00:00:ac:12:80:01 ethertype IPv4 (0x0800), length 76: 172.18.128.1.ssh > 155.xx.xx.xx.56365: S 1308033114:1308033114(0) ack 1315850475 win 5792 00:43:44.896482 In 00:00:ac:12:80:01 eth