Dropped packets - tcpdump

Dropped packets - tcpdump

[Cloves Pereira Costa Jr]

Hi all...

Anyone knows if there is some way to log the dropped packets in tcpdump?
I already search in google for it but didn't find anything...

Thxs

[]s

-- 
Cloves Pereira Costa Jr
M2Sys Tecnologia

+55 41 3271-4400
+55 41 8413-6740
www.m2sys.com.br
cloves.costa@m2sys.com.br

Re: Dropped packets - tcpdump

[Svein Ove Aas]

On Feb 6, 2008 1:07 PM, Cloves Pereira Costa Jr
<cloves.costa@m2sys.com.br> wrote:
> Hi all...
>
> Anyone knows if there is some way to log the dropped packets in tcpdump?
> I already search in google for it but didn't find anything...

The reason they're dropped in the first place is that your system is
too slow to do.. whatever you're doing with them, in realtime, and not
dropping packets would result in an infinitely growing buffer.

I don't know how you might configure the size of that buffer (a larger
one /would/ quite possibly help), but if you dump to disk using the -w
(and -s 0?) parameter, that might help.

Otherwise, get a faster machine. ;)

-- 
In a demon-haunted world, science is a candle in the dark
http://dresdencodak.com/

Re: Dropped packets - tcpdump

[Cloves Pereira Costa Jr]

Hi...

My machine is a DELL PowerEdge 2500 with 2 CPU PIII 1 GHz, 2 GB RAM, 250
GB HD SCSI... This configuration is slow?

One more question, the fact that tcpdump drop the packets don't imply
that theese packets are being dropped also in the comunication?

[]s

Cloves

Em Qua, 2008-02-06 às 19:42 +0100, Svein Ove Aas escreveu:
> On Feb 6, 2008 1:07 PM, Cloves Pereira Costa Jr
> <cloves.costa@m2sys.com.br> wrote:
> > Hi all...
> >
> > Anyone knows if there is some way to log the dropped packets in tcpdump?
> > I already search in google for it but didn't find anything...
> 
> The reason they're dropped in the first place is that your system is
> too slow to do.. whatever you're doing with them, in realtime, and not
> dropping packets would result in an infinitely growing buffer.
> 
> I don't know how you might configure the size of that buffer (a larger
> one /would/ quite possibly help), but if you dump to disk using the -w
> (and -s 0?) parameter, that might help.
> 
> Otherwise, get a faster machine. ;)
> 

Re: Dropped packets - tcpdump

[Svein Ove Aas]

On Feb 6, 2008 8:03 PM, Cloves Pereira Costa Jr
<cloves.costa@m2sys.com.br> wrote:
> Hi...
>
> My machine is a DELL PowerEdge 2500 with 2 CPU PIII 1 GHz, 2 GB RAM, 250
> GB HD SCSI... This configuration is slow?
>
For some purposes, yes. How many packets a second were you handling,
and how? How large were they/how many kilobytes/second? SSH session,
perhaps?


> One more question, the fact that tcpdump drop the packets don't imply
> that theese packets are being dropped also in the comunication?
>
It doesn't imply anything either way. They may be being dropped, or
not, depending on the actual system load and interface capacity;
tcpdump uses a lot more CPU time than the normal path.