On Sep 29, 2004, at 6:16 AM, Cardenas Arevalo Gustavo Antonio wrote:
All datagrams IP that I captured about one connection TCP,
the IP header has "4000" (hex) as more fragments flag and
fragment offset.
That's the "don't fragment" flag, the "more fragments" flag, and
fragment offset; 0x2000 is "mo
David,
the drop counter in pcap_stats() shows the number packets rejected by the
NPF driver's tap function because of lack of space in the kernel buffer.
A cause of the difference between the user and kernel counters could be that
you have packets still to be processed by your application: the pa
Tyr to play with pcap_setmintocopy() to change the amount of buffering in
the driver. A small value of the size parameter should decrease the latency,
but will increase CPU usage under low network loads.
Loris
- Original Message -
From: "Dave Ungerer" <[EMAIL PROTECTED]>
To: <[EMAIL PR
Hi,
I have the book (TCP/IP Illustrated, Volumen 1, W. Richard Stevens).
but excuse me!!
All datagrams IP that I captured about one connection TCP,
the IP header has "4000" (hex) as more fragments flag and
fragment offset. A host send a sequence of 1635 bytes.
I see:
a) A first packet IP with
KanjiSoft Systems wrote:
There a great book by Stevens called TCP/IP illustrated that explains
these points in great detail. If you're reconstructing fragmented
packets, you will need this kind of familarity.
"TCP/IP Illustrated, Volume 1: The Protocols":
http://www.amazon.com/exec/obido
