Login | Register For Free | Help
Search for: (Advanced)

Mailing List Archive: NTop: Dev
PF_RING packets partial capture/transmission
 

Index | Next | Previous | View Flat


dljavsjakojhujni at gmail

May 1, 2012, 9:09 AM


Views: 406
Permalink
PF_RING packets partial capture/transmission

Hi,
I develop a Linux sniffer application , which uses libpcap 1.2.0 library,
which, in turn, uses PF_RING infrastructure to retrieve captured packets.
The problem is that on some Suse 2.6 kernel machine, which is pretty much
usual, SOMETIMES SOME packets are captured partially, i.e. tpacket_hdr
structure tp_snaplen value is less then tp_len value. I see this right
after that libpcap code calls RING_GET_FRAME on pcap_t handle, so my
assumption is that libpcap in not "guilt" here.

I'm really sorry for the "SOMETIMES", but I've failed to isolate a problem,
it may happen on single connection for a number of packets, while the rest
are OK.

So before I drill down to PF_RING and kernel debugging, may some of your
guys have an idea why that weird stuff may happen?

Subject User Time
PF_RING packets partial capture/transmission dljavsjakojhujni at gmail May 1, 2012, 9:09 AM
    Re: PF_RING packets partial capture/transmission deri at ntop May 1, 2012, 10:56 AM
        Re: PF_RING packets partial capture/transmission dljavsjakojhujni at gmail May 1, 2012, 3:41 PM

  Index | Next | Previous | View Flat
 
 


Interested in having your list archived? Contact Gossamer Threads
 
  Web Applications & Managed Hosting Powered by Gossamer Threads Inc.