Re: I would like to tcpdump and get all the packets...

From: Edwin Groothuis (edwin_at_mavetju.org)
Date: 09/18/03

  • Next message: Lev Walkin: "Re: I would like to tcpdump and get all the packets..." 
    Date: Thu, 18 Sep 2003 11:42:03 +1000
To: Josh Brooks <user@mail.econolodgetulsa.com>

    On Wed, Sep 17, 2003 at 06:31:03PM -0700, Josh Brooks wrote:
    > Whenever I run:
    >
    > tcpdump -vvv
    >
    > when I am finished, I am surprised to see:
    >
    > 27441 packets received by filter
    > 7866 packets dropped by kernel

    That's because the buffer of captures-but-not-yet-processed packets
    in tcpdump was filled up. In other words, your system is to slow
    to process the amount of traffic going through your machine.

    Edwin 

    -- 
Edwin Groothuis      |            Personal website: http://www.mavetju.org
edwin@mavetju.org    |    Weblog: http://www.mavetju.org/weblog/weblog.php 
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
  • Next message: Lev Walkin: "Re: I would like to tcpdump and get all the packets..."

    Relevant Pages

    • Re: TCP Dump Filters
      ... but can you FILTER on the contents of the payload? ... filter on all kinds of packet characteristics like port, ... would be a major drawback in the use of TCPdump as an IDS engine. ...
      (Focus-IDS)
    • odd tcpdump output w/ 6.0-BETA2 ...
      ... I get useless output from tcpdump (no ... header or protocol decode) but only when I specify a filter on the ... use -v or -vv for full protocol decode ... packets received by filter ...
      (freebsd-net)
    • Re: Packet capturing, iptables and eth0 vs. dummy0
      ... That's because when you try locally, you end up using lo0, not eth0. ... > Let's say that I'm filtering all incoming TCP SYN packets on all ... > I'm listening, with tcpdump, to all packets in eth0. ... > connect (without the filter I can do it normally), ...
      (Linux-Kernel)
    • RE: newbie tcpdump question
      ... And tcpdump will allow you to see data between points. ... On my local network there are two totally different subnets together ... traffic between the ordinary IP numbered hosts and other ordinary IP ... not been able to come up with a tcpdump filter that actually works to do ...
      (Focus-IDS)
    • Re: tcpdump: capturing traffic only from external hosts
      ... Second filter, ... tcpdump on the host 10.0.0.101, so I have scrubbed the host bit, and used the ... port number to restrict the logging against that port. ... Unfortunately tcpdump logs the traffic before the netfilter, ...
      (comp.os.linux.networking)