Re: N! packets dropped by kernel

From: Dan Nelson (dnelson_at_allantgroup.com)
Date: 05/15/03

  • Next message: Philip Hallstrom: "Re: Bandwith Monitoring Command/port Software" 
    Date: Thu, 15 May 2003 14:16:46 -0500
To: David Smithson <david@customfilmeffects.com>

    In the last episode (May 15), David Smithson said:
    > Hi. I have a situation which may or may not be a problem. Here's my ip
    > configuration:
    >
    > nge0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    > media: Ethernet autoselect (1000baseTX <full-duplex>)
    > nge1: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
    > media: Ethernet autoselect (1000baseTX <full-duplex>)
    >
    > I've been monitoring net traffic with tcpdump. Most traffic is SMB
    > and NMB. Tcpdump reports a very high dropped:received packet ratio.
    > For example, a few second of capture during peak traffic returns:
    >
    > 34964 packets received by filter
    > 34085 packets dropped by kernel
    >
    > Should I be concerned? I'll include full tcpdumps on both interfaces if
    > necessary. Thanks for your time.

    It means you need a faster CPU :) Tcpdump was only able to display
    half the packets it got, and the kernel had to drop the rest.
    Depending on what you're doing, writing to a file (-w logfile.txt),
    grabbing less bytes per packet (-s), limiting which packets to display
    (with a tighter filter expression), or raising the in-kernel buffersize
    (sysctl debug.bpf_bufsize) may work as well.

    I'm capturing (not decoding; just writing to disk) packets from four
    fxp interfaces on a 586-200 (no MMX even!), and my CPU load doesn't go
    over 10%. A machine 10x faster should be able to monitor two
    interfaces 10x the speed of mine with no problems. 

    -- 
	Dan Nelson
	dnelson@allantgroup.com
_______________________________________________
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"
  • Next message: Philip Hallstrom: "Re: Bandwith Monitoring Command/port Software"

    Relevant Pages