BPF tweak; negative impact?
Scott A. McIntyre
scott at xs4all.nl
Wed Feb 21 15:22:02 EST 2001
Could the bpf tweak for FreeBSD and argus be causing a severely negative
impact upon other applications that are BPF intensive? For example,
I've seen the following from one application:
received 98933 packets and dropped 32460(32.810%) packets.
tcpdump 3.6.2 says:
58926 packets received by filter
54615 packets dropped by kernel
(using libpcap 0.6.2, as well)
Now, that improves dramatically (in the tcpdump case) if I log to a
file only, but even so, I'm concerned that more data may be going
missing than I intend.
Is there a way to get these sort of statistics from argus; how many
packets were seen by the kernel, but dropped before the bpf buffer could
be emptied?
Thanks,
Scott
More information about the argus
mailing list