On Aug 30, 2009, at 8:26 PM, Stephen Donnelly wrote:
The current 'drop' count in libpcap is not intuitive, and frequently
arguably undercounts since it does not include 'rx buffer overflow'
and similar interface/OS specific packet loss. OTOH, the
documentation is quite clear about what it does count I think.
I would not recommend changing the definition or Linux
implementation at this point. It would change the behaviour for
existing applications and would only cause further confusion.
Counting interface drops in ps_drop would definitely be wrong, because
it doesn't do so on other platforms, and there's already a ps_ifdrop
field to count interface drops.
I think the current libpcap statistics interface is not very useful
because it is underspecified and varies too much between platforms.
Hopefully for pcap-ng (the portable packet capture library, not the
file format) we can get a better live statistics interface which is
more tightly defined and can conserve meaning across platforms.
We should add to libpcap an API that supplies a pcap-ng Interface
Statistics Block, so that
1) it can supply only those statistics that are available on the
platform in question, explicitly indicating which ones it's supplying;
2) the set of statistics it supplies can be extended (so we don't
have to anticipate, when we initially design the API, all possible
packet statistics that could ever be obtained from any current or
future platform and that an application would want);
3) we don't end up with two *separate* ways of doing that, requiring
that a "libpcap interface statistics block" be translated to a "PCAP-
NG Interface Statistics Block" before being written to a file.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
