BPF tweak; negative impact?

Scott A. McIntyre scott at xs4all.nl
Wed Feb 21 15:22:02 EST 2001


Could the bpf tweak for FreeBSD and argus be causing a severely negative
impact upon other applications that are BPF intensive?  For example,
I've seen the following from one application:

received 98933 packets and dropped 32460(32.810%) packets.

tcpdump 3.6.2 says:

 58926 packets received by filter
 54615 packets dropped by kernel

(using libpcap 0.6.2, as well)

Now, that improves dramatically (in the tcpdump case) if I log to a
file only, but even so, I'm concerned that more data may be going
missing than I intend.

Is there a way to get these sort of statistics from argus; how many
packets were seen by the kernel, but dropped before the bpf buffer could
be emptied?

Thanks,

Scott



More information about the argus mailing list