Re: [tcpdump-workers] libpcap MMAP, Shared Memory version?

2011-12-16 Thread Jon Schipp
things that I have to do, tcpdump/libpcap or maybe OS related? Thanks Jon On Sun, Nov 27, 2011 at 11:15 PM, Guy Harris wrote: > > On Oct 10, 2011, at 7:36 PM, Jon Schipp wrote: > >> Are there any plans for a shared memory libpcap version from you guys? >> I know that there are

[tcpdump-workers] libpcap MMAP, Shared Memory version?

2011-11-27 Thread Jon Schipp
Are there any plans for a shared memory libpcap version from you guys? I know that there are some other that have modified libpcap to use mmap() such as Phil's: public.lanl.gov/cpw I was just curious to whether you guys have anything or are planning to, or not at all. Thanks -- - Jon -- ---

[tcpdump-workers] [Libpcap] Linux ps_drop()

2011-11-27 Thread Jon Schipp
Hello Guy, all, I'm going through some past mailing lists posts and I found this, which may have answered my question on where libpcap on Linux gets its drop count: http://seclists.org/tcpdump/2010/q3/46 "You have a recent version of libpcap, and a recent kernel, so pcap_stats() should be getting

Re: [tcpdump-workers] questions on -B, performance, mbufs, and

2011-09-27 Thread Jon Schipp
onfig? Sorry for all the questions. I will be giving a presentation at a security conference next month and I just want to make sure I get everything as correct as I can. Most of the questions are just for verification. Thanks On Thu, Sep 15, 2011 at 1:40 PM, Guy Harris wrote: > > On Sep 15, 20

Re: [tcpdump-workers] questions on -B, performance, mbufs, and

2011-09-15 Thread Jon Schipp
at 2:53 AM, Guy Harris wrote: > > On Sep 13, 2011, at 8:47 PM, Jon Schipp wrote: > > > I have a few questions, hopefully someone can set me straight. > > Info: *I'm on FreeBSD 8.2* *out of a couple million packets, in a few > hours > > time, I drop around 4000*

[tcpdump-workers] questions on -B, performance, mbufs, and libpcap buffers

2011-09-13 Thread Jon Schipp
Hey guys, I have a few questions, hopefully someone can set me straight. Info: *I'm on FreeBSD 8.2* *out of a couple million packets, in a few hours time, I drop around 4000* First off are all packets stored in mbufs? And if so, is it possible to increase the amount of mbuf clusters to improve tcp