BPF tweak; negative impact?

Scott A. McIntyre scott at xs4all.nl
Thu Feb 22 12:07:47 EST 2001


> didn't report drops), testing with tcpreplay to provide a known packet stream
> at HDX 100 indicates (on the same machine using an early beta) that Linux
> indeed captured everything and FreeBSD lost some packets below the level of
> BPF. Running argus and tcpdump on the same interface on a busy 100 link under
> FreeBSD (don't know about Linux because haven't tried) will cause packet loss.

I have heard from a number of folks today about potential increased
lossage with the use of the fxp (Intel EtherExpress) driver under
FreeBSD 4.2-Release.

Apparently, in earlier versions, there was greater stability/consistency
of data reporting, but with the current round there may be an
interaction taking place which is making my drop rate increased.

In testing with a variety of packet logging applications, the result is
esssentially the same, on FreeBSD, losses are high under a moderately
busy network link.

I'm going to see if I can scare up another 3com card, or even DEC Tulip
based chipset, and see if that increases performance as well.

Scott



More information about the argus mailing list