On Feb 5, 2011, at 11:20 PM, M. V. wrote:
> as i mentioned in my previous mail, (with the title: "HUGE packet-drop") i'm
> having problem trying to dump gigabit traffic on harddisk with tcpdump on
> Debian5.0. i tried almost everything but got no success.
Did you try to check whether the memory-mapped "tpacket" mechanism was being
used by libpcap?
> From: Jesper Dangaard Brouer <h...@comx.dk>
> Subject: Re: [tcpdump-workers] HUGE packet-drop
> Date: January 31, 2011 10:56:22 AM PST
> To: tcpdump-workers@lists.tcpdump.org
...
> The easiest way to see if you are using the MMAPed version is to look in:
> /proc/net/ptype
>
> Your are using the MMAP version if the Function "tpacket_rcv" is listed (while
> you perform a tcpdump). Notice the "t" in front of "packet_rcv", if the "t" is
> missing, then you are using the old/normal version.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
