Hi all,

I have a question regarding packet drops.

I am running a test to determine when packet drops occur. I'm using a Spirent TestCenter through a switch (necessary to aggregate Ethernet traffic from 5 ports to one optical link) to a server using a Myricom card.

While running my test, if the input rate is below a certain value, ethtool does not report any drop (except dropped_multicast_filtered which is incrementing at a very slow rate). However, tcpdump reports X number of packets "dropped by kernel". Then if I increase the input rate, ethtool reports drops but "ifconfig eth2" does not. In fact, ifconfig doesn't seem to report any packet drops at all. Do they all measure packet drops at different "levels", i.e. ethtool at the NIC level, tcpdump at the kernel level etc?

And am I right to say that in the journey of an incoming packet, the NIC level is the "so-called" first level, then the kernel, then the user application? So any packet drop is likely to happen first at the NIC, then the kernel, then the user application? So if there is no packet drop at the NIC, but packet drop at the kernel, then the bottleneck is not at the NIC?

Thank you.

Regards,
Rayne

I think the tcpdump error is specific to the application and is not related to network traffic flows. All tcpdump is saying is "there's too many packets for me to decode" and has no bearing on your FTP download for example. As for the ifconfig and ethtool ouputs, I'm not exactly sure. It appears that ifconfig pulls stats from /proc/net/dev whereas ethtool queries the hardware (NIC) directly. From what I've found, the frequency in which the /proc/net/dev file gets updated can cause applications (such as ifconfig) to misinterpret the data.