4.9-STABLE heavily dropping packets? libpcap issue?

[Petri Helenius]

Guy Helmer wrote:

>Emre Bastuz wrote on Thursday, February 12, 2004 3:43 PM
>  
>
>>Hi,
>>
>>for sniffing purposes I have a FreeBSD 4.9-STABLE box running on highend,
>>state-of-the-art hardware (Xeon something) with all bells and whistles.
>>
>>The NIC´s an onboard copper em0 with gig-e capabilities.
>>
>>Nevertheless I am getting massive packet drops (40%-60%) when I
>>start sniffing a
>>gigabit ehthernet segment although the CPU load is very low.
>>
>>After doing some research in in the appropriate mailing list
>>archives I found
>>out that there are (or were?) sometimes issues with the libpcap.
>>As there was a
>>more current one in the ports collection (0.8.1 as opposed to 0.7
>>in the base
>>system) I used this instead (with LIBPCAP_OVERWRITE_BASE=yes) but
>>still I am
>>losing the same amount of packets when doing a tcpdump.
>>    
>>
>
>I don't know what libpcap in ports does regarding the size of the packet
>capture read buffer, but I've modified the stock libpcap's pcap-bpf.c so it
>offers to use a buffer much larger than 32768 bytes (look for the loop that
>has the line
>
>	for (v = 32768; v != 0; v >>= 1) {
>
>and increase 32768 to something more reasonable (say, 1048576).
>
>I've also set the debug.bpf_bufsize and debug.bpf_maxbufsize sysctls to
>match the number in pcap-bpf.c.
>
>  
>
This is also fixed in more current libpcap version, however that has not 
been ported to the tree.

Pete