Analysing network traffic

jayeola · 06-25-2006, 04:21 PM

hey guys,

I ran tcpdump and iwevent at the same time to see how well a network was performing. iwevent reported dropped packets as they were being dropped (i.e. dynamically) but tcpdump told me that the kernel dropped no packets.

What gives? Is the kernel looking at a different type of packet? Why should one command see none dropped and the other tell me that they are being dropped?

sonajiso · 06-27-2006, 03:29 AM

iwevent deals with Link layer (OSI layer 1) packets, whereas the linux kernel deals with Network Layer (OSI level 3) and higher packets. Packets dropped (aka deemed erronous) at a lower level should under no circumstance make it higher layers. So what you've seen is expected behaviour. To understand why this is so, read up on OSI and basic networking concepts.

jayeola · 06-28-2006, 01:30 PM

Thanks. Wiil read up on this subject. Networkign was always my weakness.