Content-Type: text/plain; charset=US-ASCII
Hello all,
I'm wondering about making the ps_drop do something on Linux 2.4.x machines.
I just read through the archives and saw this matter discussed a couple
weeks ago and would like to add some input, having just joined the list.
The way I understand it, pcap is incrementing ps_recv every time it reads
from the socket. Is this intended to be a packets that passed the filter or
packets seen on the wire? The way I see it, on Linux, it is packets that
passed the filter which is available from the kernel in the tp_packet
variable. If this information, and the information from tp_drops is
available from the getsockopt call, can they be used in pcap-linux.c?
In the SOL_PACKET/PACKET_STATISTICS getsockopt tp_packets counts the packets
that pass filtering and tp_drops counts packets that packet_rcv couldn't
deal with. Just before these statistics are passed through getsockopt()
tp_packet is set to tp_packet += tp_drops. So that gives us:
tp_packet - tp_drops = total packets passed by filter
tp_drops = total packets dropped
In my (minimal so far, still going) tests tp_packet-tp_drops has always been
equal to the current amount returned by pcap_stats and on Linux pcap_stats
doesn't provide packet drop count.
If I am mistaken on the packet count (and please set me straight if I am)
could the getsockopt call at least be used to provide some value to the
dropped statistic using tp_drops? I have some working code against
libpcap-2001.07.24 and could generate a patch if needed.
Cheers,
Scott
--
"as we enjoy great advantages from the inventions of others,
we should be glad of an opportunity to serve others by any invention
of ours; and this we should do freely and generously."
--Benjamin Franklin
