M. V. <bored_to_death85 <at> yahoo.com> writes: > so, i dont know what else to do, seems like nothing works for me :-S > 1) does anyone have any other suggestions that may help? > 2) about MMAP support in Debian kernel: i installed Debian5.0.3 from original > ISO file. does anyone know if MMAP exists in its kernel by default? how can i > get sure about that?
The easiest way to see if you are using the MMAPed version is to look in: /proc/net/ptype Your are using the MMAP version if the Function "tpacket_rcv" is listed (while you perform a tcpdump). Notice the "t" in front of "packet_rcv", if the "t" is missing, then you are using the old/normal version. If I remember correctly, you need at least libpcap 1.0.0 to have MMAP/tpacket_rcv support. And I think that if you compile libpcap on a Debian 5.0/lenny, you will not get MMAP support, because this Debian has to old version of the kernel headers. AFAICR, MMAP support got added in kernel 2.6.27 and Debian lenny runs 2.6.26. Cheers, -- Best regards Jesper Brouer ComX Networks A/S Linux Network Kernel Developer Cand. Scient Datalog / MSc.CS Author of http://adsl-optimizer.dk LinkedIn: http://www.linkedin.com/in/brouer - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
