BPF tweak; negative impact?

[Carter Bullard]

Oh yes,
   The man status records give packets dropped status just like
tcpdump does, so if you want to get frequent reporting, run
argus with "-M 60" or "-M 30" to get argus status records
every 60 or 30 seconds.

Carter

Carter Bullard
QoSient, LLC
300 E. 56th Street, Suite 18K
New York, New York  10022

carter at qosient.com
Phone +1 212 588-9133
Fax   +1 212 588-9134

> -----Original Message-----
> From: owner-argus at lists.andrew.cmu.edu
> [mailto:owner-argus at lists.andrew.cmu.edu]On Behalf Of Scott 
> A. McIntyre
> Sent: Wednesday, February 21, 2001 3:22 PM
> To: Argus Mailing List
> Subject: BPF tweak; negative impact?
> 
> 
> Could the bpf tweak for FreeBSD and argus be causing a 
> severely negative
> impact upon other applications that are BPF intensive?  For example,
> I've seen the following from one application:
> 
> received 98933 packets and dropped 32460(32.810%) packets.
> 
> tcpdump 3.6.2 says:
> 
>  58926 packets received by filter
>  54615 packets dropped by kernel
> 
> (using libpcap 0.6.2, as well)
> 
> Now, that improves dramatically (in the tcpdump case) if I log to a
> file only, but even so, I'm concerned that more data may be going
> missing than I intend.
> 
> Is there a way to get these sort of statistics from argus; how many
> packets were seen by the kernel, but dropped before the bpf 
> buffer could
> be emptied?
> 
> Thanks,
> 
> Scott
> 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20010221/f9fb093d/attachment.html>