Do you mean that if there is a large traffic flow on the nic,the tcpdump will show 'dropped packets'?
------------------ Original ------------------ From: "David Nalley"<da...@gnsa.us>; Date: Sat, Jul 20, 2013 09:47 AM To: "users"<users@cloudstack.apache.org>; Subject: Re: packets dropped by kernel on host node management nic On Fri, Jul 19, 2013 at 9:42 PM, WXR <1485739...@qq.com> wrote: > I use cloudstack4.1 basic network. > When I use tcpdump to capture packets on the management nic of the host > node,it will be like this: > > [root@cs-kvm02 opt]# tcpdump -c 10000 -w /test.pcap -vv > tcpdump: listening on cloudbr0, link-type EN10MB (Ethernet), capture size > 65535 bytes > 10000 packets captured > 10515 packets received by filter > 481 packets dropped by kernel > > I don't know if it is normal,I think it should be "0 packets dropped by > kernel". So tcpdump has a buffer, and if tcpdump doesn't clear the buffer fast enough - the kernel will overwrite the buffer and 'drop packets' See the tcpdump manpage for more information. --David .
