On Aug 28, 2009, at 1:24 PM, Dustin Spicuzza wrote:
Dustin Spicuzza wrote:
So after reading the libpcap and kernel source, I see that this is
actually how its supposed to work. But it *seems* like it would be
quite
nice if we could grab the interface driver drop statistics as well as
drops resulting from the capture buffer filling up.
I'm looking for a way to query the kernel about this number --
should I
bother submitting a patch if I can get it, or is the current behavior
more desired?
It appears that the only way to get this number is by looking at
/proc/stats/dev, so I added something that can parse it for the
correct
interface, and get the drop stats from there. Since those are
cumulative
over the boot time of the system, it stores a number and does
incremental updates of the number. It doesn't do this when not in
promiscuous mode however, since that doesn't make any sense.
It works for me, let me know what you think.
I think that
+ handle->md.stat.ps_drop += (handle->md.proc_dropped -
if_dropped);
and
+ stats->ps_drop = handle->md.stat.ps_drop;
are wrong, because ps_drop is supposed to reflect the number of
packets dropped by the packet capture mechanism because they arrived
faster than the app could consume them, but not the number of packets
dropped by the adapter or adapter driver before they even made it to
the capture mechanism. ps_ifdrop is for the latter (and the comment
about it being unimplemented is false on Tru64 UNIX, for example, so
don't let that comment scare you off).
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
