4.9-STABLE heavily dropping packets? libpcap issue?

[Guy Helmer]

Emre Bastuz wrote on Thursday, February 12, 2004 3:43 PM
> Hi,
>
> for sniffing purposes I have a FreeBSD 4.9-STABLE box running on highend,
> state-of-the-art hardware (Xeon something) with all bells and whistles.
>
> The NIC´s an onboard copper em0 with gig-e capabilities.
>
> Nevertheless I am getting massive packet drops (40%-60%) when I
> start sniffing a
> gigabit ehthernet segment although the CPU load is very low.
>
> After doing some research in in the appropriate mailing list
> archives I found
> out that there are (or were?) sometimes issues with the libpcap.
> As there was a
> more current one in the ports collection (0.8.1 as opposed to 0.7
> in the base
> system) I used this instead (with LIBPCAP_OVERWRITE_BASE=yes) but
> still I am
> losing the same amount of packets when doing a tcpdump.

I don't know what libpcap in ports does regarding the size of the packet
capture read buffer, but I've modified the stock libpcap's pcap-bpf.c so it
offers to use a buffer much larger than 32768 bytes (look for the loop that
has the line

	for (v = 32768; v != 0; v >>= 1) {

and increase 32768 to something more reasonable (say, 1048576).

I've also set the debug.bpf_bufsize and debug.bpf_maxbufsize sysctls to
match the number in pcap-bpf.c.

Maybe this will help,
Guy Helmer