(Note: I sent this once but it must have gotten eaten by the email
monster. If it arrives twice I appologize.)
Hello,
I am wondering about the pcap_stats function on Linux 2.4.x systems. I
read the posts from a couple weeks ago and, being new to the list, I'd
like to add my input and request the use of the
SOL_PACKET/PACKET_STATISTICS getsockopt call.
It seems to me that pcap-linux is counting the number of packets that pass
the filter in ps_recv and it does nothing with ps_drop. The kernel
already provides both of these statistics so I'm wondering if there is a
particular reason that they aren't being pulled from there. Is the intent
of ps_recv to count packets seen on the wire or packets that pass the
filter? On Linux it seems with socket filter enabled one can only get
packets that pass the filter using either method.
The getsockopt call returns tp_packet and tp_drops. tp_drops is
incremented when various things in packet_rcv fail and tp_packet ends up
being set to the number of packets that pass the filter and the number of
drops (set to tp_packet += tp_drops before getsockopt returns). This
gives us number of packets that pass the filter (as tp_packet-tp_drops)
and the number of packets dropped allowing pcap to make use of ps_drop on
Linux 2.4.x systems.
I've done a few tests with pcap-current from 7/24 and the numbers (with
tp_packet/ps_recv) are consistantly matching up. Its a fairly trivial
addition and I can produce a patch easily enough. What is the consensus
on this?
-Scott
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
