Hi, All, I have a problem about libpcap ring buffer. The problem is the packets captured by libpcap1.1.1 which uses ring buffer are truncated. The detail is as the following. I have two machines. One is A, one is B. A and B are connected directly by twisted pair with Giga Ethernet NICs.I used tcpreplay to send packets from A to B and capture data with tcpdump for both A and B. I found many of packets whth UDP payload truncated for B, the receiver, but not for A. This problem is found for tcpdump4.1.1 with libpcap1.1.1. I made the same test with tcpdump3.4 with libpcap0.9.4. This problem is not seen. The difference between these two tests are two libpcaps are different version. One is 0.9.4, which does not use ring buffer, one is 1.1.1, which used ring buffer. The two machines are installed Suse Linux 10.2, the kernel is 2.6(I forgot the detail version info, if needed, I can add later). I also tested to send data to B from C by LAN from another NIC. The libpcap is 1.1.1. This truncate problem is not seen. So the problem is related with NIC direct connection and libpcap ring buffer, I think. Till now I still can not figure out what is wrong. Maybe it is my NIC problem? But I found same problem when I send packets from B to A and capture packets at B. Is it a bug of libpcap 1.1.1? I think it is not. Maybe it is my NIC configuration problem? But I checked with ethtool and ifconfig and found nothing to add or change. The two GE NIC are working at 1000Mbps full mode. Or it is a SuSe Linux bug? Anyone can help? Thanks a lot! Roger
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
