Re: [tcpdump-workers] How to set snaplen for tcpdump

the smallest number that will capture the proto‐ col information you're interested in. Setting snaplen to 0 means use the required length to catch whole packets. So -s is the command-line option you want to use! regards Fabian Schneider

Re: [tcpdump-workers] where does PCAP timestamp before or after the

ver function. But what exactly is the "MAC scheduler"? I have not yet heard of it. mfG Fabian Schneider -- Fabian Schneider, Technische Universität München address: Boltzmannstr. 3, 85748 Garching b. Münchenn e-mail: [EMAIL PROTECTED], WWW: http://www.net.in.tum.de/~schneifa

Re: [tcpdump-workers] How to make libpcap work in MMAP mode

AP_FRAMES=max with the mmaped version for maximal effeiciency. For more detail take a look at: http://public.lanl.gov/cpw/ regards Fabian Schneider -- Fabian Schneider, Technische Universität München address: Boltzmannstr. 3, 85748 Garching b. Münchenn e-mail: [EMAIL PROTECTED],

Re: [tcpdump-workers] didnt grab packet

Hi, I found the bug in your code: Please remove the semicolon after the paratheses of the if clause. And everything should work fine! > if(packet == NULL); > { > printf("Didnt grab packet %s\n",errbuf); > exit(1); > } mfG Fabian Schneider -- Fabi

Re: [tcpdump-workers] pcap_loop() not returning after pcap_breakloop()

ble to do it with pthread_cancel(), although that will, > ultimately, terminate the thread (unless a cleanup handler never returns). And this sound like a dirty hack, where additional effort is required to perform the normal cleanup at the end. regards Fabian Schneider -- Fabian Schneider, Techn

Re: [tcpdump-workers] Filter complexity and performance

t: http://www.net.informatik.tu-muenchen.de/~schneifa/papers/da.pdf (on page 40 (in Document count) section 6.3.1) bye Fabian -- Fabian Schneider (Dipl. Inf.), An-Institut Deutsche Telekom Laboratories Technische Universitaet Berlin, Fakultaet IV -- E-Technik und Informatik address: Se

Re: [tcpdump-workers] Packet capture performance comparison of

speed, > while writing some packets to disk. Has anyone out there put together > such a box and come up with some performance statistics? We are hopefully going to do this soon, but i cannot promise a date. best Fabian -- Fabian Schneider (Dipl. Inf.), An-Institut Deutsche Teleko

Re: [tcpdump-workers] NIC / driver performance with libpcap

t to enable NAPI for Linux. For 10-GigEthernet i heard (no own experience) that the Neterion Cards are good. Those are available in a special Solaris version as well. bye Fabian Schneider -- Fabian Schneider (Dipl. Inf.), An-Institut Deutsche Telekom Laboratories Technische Universitaet B

Re: [tcpdump-workers] NIC / driver performance with libpcap

tips on this topic. best Fabian [1] http://www.net.t-labs.tu-berlin.de/papers/SWF-PCCH10GEE-07.pdf [2] http://www.net.t-labs.tu-berlin.de/papers/S-PEPCSHN-05.pdf -- Fabian Schneider (Dipl. Inf.), An-Institut Deutsche Telekom Laboratories Technische Universitaet Berlin, Fakultaet IV -- E

Re: [tcpdump-workers] pcap performance question

rmance is only slightly affected. See Sections 6.3.2 and 6.3.3 in my thesis: http://www.net.t-labs.tu-berlin.de/~fabian/papers/da.pdf best Fabian Schneider -- Fabian Schneider (Dipl. Inf.), An-Institut Deutsche Telekom Laboratories Technische Universitaet Berlin, Fakultaet IV -- E-Tec

Re: [tcpdump-workers] pcap_setbuf not available in linux

Hi Ritesh, 1. In this I want to set the kernel buffer for pcap driver, for this function pcap_setbuff is not available, but this same function is available in windows. So how we can set the pcap driver packet queue kernel buffer in linux? Is their any way through which we can include the p

Re: [tcpdump-workers] Multiple pcap filters on interface

best Fabian [1] http://read.cs.ucla.edu/click/ -- Fabian Schneider (Dipl. Inf.), An-Institut Deutsche Telekom Laboratories Technische Universitaet Berlin, Fakultaet IV -- E-Technik und Informatik address: Sekr. TEL 4, Ernst-Reuter-Platz 7, 10587 Berlin e-mail: [EMAIL PROTECTED], WWW: http

Re: [tcpdump-workers] Best OS / Distribution for gigabit capture?

Hi, Regarding the OS we have done testing on this some five years ago. Back then we found that FreeBSD performed better than Linux. Yet there have been improvements proposed for both Linux (memory mapping, and Luca Deri's work) and FreeBSD ("zero-copy BPF and Alexandre Fiveg's work). To get det

Re: [tcpdump-workers] Where does libpcap get the incoming network data? From the driver?

Hi, that depends on the OS. > 1. Does libpcap obtain incoming packet data from the nic's driver or from > somewhere else? > 2. Does libpcap obtain outgoing packet data from the linux IP layer or from > somewhere else? Actually it is in between. What happens is that libpcap requests a PF_PACKE