Hello, We have the following configuration: 2 Xeon 2800 MHz, 512 KB L2 Cache 1 GB RAM 70 GB Hardware RAID-0 on Compaq SmartArray controller 4 Intel EEPRO Fast Ethernet cards (eth0-3) 2 Broadcom Gigabit cards (eth4-5) Linux-2.4.20 libpcap 0.7.2 and tcpdump 3.7.2 In our attempts to configure our server to be able to capture network packets at up to 70,000 packets per second per interface we have come accross the following problem: We see tcpdump reporting "xyz packets dropped by kernel" on the 100 Tx card(s). We begin to see this message when our packet rates exceed 10,000 packets/sec/interface. The packet size is currently 70 bytes. We have proven that the kernel is correctly recording the number of packets, however TCPdump (of libpcap?) appears to be dropping some. Can you please tell us how we can determine where the problem is and if we are missing any parameters/settings that we should set from kernel and/or tcpdump/libpcap POV? Also we have the "Packet Socket: mmaped IO" support enabled in the kernel, however is there a way to confirm if tcpdump/libpcap are utilising that feature (that is if that feature would help our scenario in the first place). Can it be confirmed by running tcpdump through strace?, if yes what is the evidence to look forward to? (is it mmap2 function calls?) Thanks for your help Hari harisri@bigpond.com - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
