Going through the man page of tcpdump here It seems kernel can drop the packets if the buffer is full. I was wondering if
1) that size is configurable and/or 2) where can I see the size for my distro?
From the man page (for easy reference):
packets ``dropped by kernel'' (this is the number of packets that were dropped, due to a lack of buffer space, by the packet capture mechanism in the OS on which tcpdump is running, if the OS reports that information to applications; if not, it will be reported as 0).
There are several areas you might check to mitigate packets dropped by kernel:
/proc/sys/net/core/netdev_max_backlog
and /proc/sys/net/core/netdev_budget
. The default is probably pretty low; try setting each to something like 2000.tcpdump
process long enough to fill the recv buffer
-nn
to turn off DNS lookups and port namingtaskset
nice
to set the priority of the processEven with those settings, it may just be that you can not keep up with the speed of the traffic you are trying to capture. Look at the details of your NIC and machine and ensure that what you expect is even possible.
1) It's configurable but not precisely as it would decide a proper size from your request.
2) Use setsockopt / getsockopt
with SO_RCVBUF / SO_SNDBUF
I'm not familiar with linux but it seems this link explains it well. http://linux.die.net/man/7/socket
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With