On Fri, Jul 19, 2013 at 9:42 PM, WXR <1485739...@qq.com> wrote: > I use cloudstack4.1 basic network. > When I use tcpdump to capture packets on the management nic of the host > node,it will be like this: > > [root@cs-kvm02 opt]# tcpdump -c 10000 -w /test.pcap -vv > tcpdump: listening on cloudbr0, link-type EN10MB (Ethernet), capture size > 65535 bytes > 10000 packets captured > 10515 packets received by filter > 481 packets dropped by kernel > > I don't know if it is normal,I think it should be "0 packets dropped by > kernel".
So tcpdump has a buffer, and if tcpdump doesn't clear the buffer fast enough - the kernel will overwrite the buffer and 'drop packets' See the tcpdump manpage for more information. --David
