LinuxQuestions.org
Visit Jeremy's Blog.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 09-17-2009, 01:34 AM   #1
Ritendra
LQ Newbie
 
Registered: Oct 2008
Location: Bangalore, India
Posts: 4

Rep: Reputation: 0
Smile Packets dropped by kernel in tcpdump


Hi,
When I am downloading a file of size <10MB and try to take tcpdump in a file there is no packet drop but if I try to download a file greater size e.g 25 MB it is dropping packets.
Following are the test cases i did.

tcpdump -i eth0 -w tcpdump1.pcap
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
^[[A^C3626 packets captured
3626 packets received by filter
0 packets dropped by kernel
file size was 3.2MB
**************************************************************************************************
tcpdump -i eth0 -w tcpdump2.pcap
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
^C1444 packets captured
1444 packets received by filter
0 packets dropped by kernel
file size 1.3 MB
**************************************************************************************************** **
tcpdump -i eth0 -w tcpdump3.pcap
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
^C19867 packets captured
24060 packets received by filter
4193 packets dropped by kernel
file size 25MB


a guidance and help in this matter is highly appreciated.
 
Old 09-17-2009, 10:04 AM   #2
nimnull22
Senior Member
 
Registered: Jul 2009
Distribution: OpenSuse 11.1, Fedora 14, Ubuntu 12.04/12.10, FreeBSD 9.0
Posts: 1,571

Rep: Reputation: 92
First, try to dump to console: tcpdump -i eth0
 
Old 09-18-2009, 04:43 AM   #3
Ritendra
LQ Newbie
 
Registered: Oct 2008
Location: Bangalore, India
Posts: 4

Original Poster
Rep: Reputation: 0
Cool reply

Hi nimnull22,
I have already done those beginning commands. But those things were not working. I finally got the solution ,that I would like to share with you guys.
Under the default FreeBSD configuration, the BPF
buffer size is set to 4096 bytes (4kB). This means that
when the BPF socket is opened by the PCAP library, it
reads this value into v. Since this is less than 32kB, v
gets instead set to 32768. The PCAP library then
attempts to set the BPF buffer size to 32kB, this call
succeeds since the default system parameters allows a
buffer size of up to 512kB to be set.
On a FreeBSD 5.3 system, both of these values can
be modified using system control variables, which can
be directly modified using the sysctl command.
./etc/sysctl.conf
just add
debug.bpf_maxbufsize=1048576

debug.bpf_bufsize=524288

and reboot it will solve the problem
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Dropped packets Doolspin Linux - Software 1 10-22-2006 01:22 PM
3899 packets dropped by kernel, about 40% abefroman Linux - Networking 1 11-17-2005 11:52 AM
too much dropped packets...Hi.. alaios Linux - Networking 2 02-10-2005 04:49 AM
tcpdump and dropped packets Blindsight Linux - Networking 5 07-14-2003 10:41 PM
dropped packets... sohmc Linux - Software 3 05-29-2003 09:26 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 01:13 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration