I would like to tcpdump and get all the packets...

[Josh Brooks]

Whenever I run:

tcpdump -vvv

when I am finished, I am surprised to see:

27441 packets received by filter
7866 packets dropped by kernel

I have pored over the tcpdump man page, but do not see how to tell it to
not drop any of the packets.

What is the purpose behind this ?  I can't think of any situation where I
would want to run tcpdump and not see certain things.

The whole point of my tcpdump usage is to try to catch some malicious
traffic that I think is hitting my system - if it is dropping so many
packets, I might never see it!

Many thanks - and also, just out of curiousity, what _is_ the situation in
which it helps to throw out 20% of the packets and not see them ?