Hello,
We have been experiencing packet loss when capturing packets from a 3G
wireless modem using Fedora 10's tcpdump. In order to avoid dropped
packets, I have been trying the PF_RING patch.
I have a few questions:
- When compiling the kernel, I always get ring.ko, even if
CONFIG_RING is set to "y". Is there a way to compile it into the
kernel, rather than having a ring.ko module file?
- When I capture eth0 using tcpdump compiled against libpfring and
the ntop libpcap, I get an entry in /proc/net/pf_ring for the tcpdump
process (which is fine). When I capture usb0, there's no entry for
tcpdump in /proc/net/pf_ring (which surprises me). Any ideas why?
(Here's the output)
[r...@t999999920 ~]# ./tcpdump -i eth0 -n -w /dev/null
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
^C216 packets captured
218 packets received by filter
0 packets dropped by kernel
[r...@t999999920 ~]# ./tcpdump -i usb0 -n -w /dev/null
tcpdump: listening on usb0, link-type USB_LINUX (USB with Linux
header), capture size 96 bytes
- When I did a capture of a 100Mb file, I got these stats at the end:
[r...@t999999920 ~]# ./tcpdump -i usb0 -n -w
test100MB-noload-nosave-PF_ring.pcap
tcpdump: listening on usb0, link-type USB_LINUX (USB with Linux
header), capture size 96 bytes
^C236764 packets captured
236764 packets received by filter
-2 packets dropped by kernel
Is it usual to get "-2 packets dropped"? What does a negative number mean?
Thank you for your help,
Mitch.
_______________________________________________
Ntop mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop
