Hello,

I use Linux Mandriva 2006 and as I describe in subject with tcpdump 50% of captured packet are missing!

[user ~]$ uname -a
Linux hostname 2.6.12-12mdksmp #1 SMP Fri Sep 9 17:43:23 CEST 2005 i686 Intel(R) Xeon(TM) CPU 3.00GHz unknown GNU/Linux
[user ~]$ /usr/sbin/tcpdump --version
tcpdump version 3.9.2
libpcap version 0.9.1
Usage: tcpdump [-aAdDeflLnNOpqRStuUvxX] [-c count] [ -C file_size ]
[ -E algo:secret ] [ -F file ] [ -i interface ] [ -M secret ]
[ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
[ -W filecount ] [ -y datalinktype ] [ -Z user ]
[ expression ]
[user ~]$ /usr/sbin/tcpdump -i eth1 >test.dump
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth1, link-type EN10MB (Ethernet), capture size 96 bytes
923 packets captured
1846 packets received by filter
0 packets dropped by kernel

An idea?

Thanks

Cedric

does the tcpdump filter, filter UDP packets as well

if so if seeing 1800 packets and only grabbing 900 would make sense


soule

after a few search it is a libpcap's bug on systems with newer
kernels (kernels supporting the PACKET_STATISTICS socket option on
PF_PACKET sockets).

The libpcap and tcpdump CVS version now works fine