Libpcap of version 1.0.0 and greater uses mmap with kernel space ring buffer.
You may see the following comments in create_ring() function, which creates this
ring and populates it with fixed size frames:
"* So, for now, we just do this for Ethernet devices, where
* there's no met
Hi,
Both machines are with Intel Gigabit Ethernet adapter, with different
revisions, though. Both use e100e driver.
So what you are actually saying, that NIC driver may handle it in a wrong
way? If so, what are the possible reasons?
How exactly you found out the driver ring frames size? Inserting
Hi,
I develop a Linux sniffer application , which uses libpcap 1.2.0 library.
The problem is that on some 2.6.16 and 2.4 kernel machines, which are
pretty much "usual", SOMETIMES SOME packets are captured partially, i.e.
tpacket_hdr structure tp_snaplen value is less then tp_len value. I see
this r
