Networking Forums

Networking Forums > Computer Networking > Linux Networking > Pcap and packets

Reply
Thread Tools Display Modes

Pcap and packets

 
 
lancer6238@yahoo.com
Guest
Posts: n/a

 
      11-10-2008, 05:42 AM
Hi,
I'm new to the world of networking, and I have some questions about
packets and pcap in general. I'm running Red Hat Enterprise Linux 5 on
a PC with QuadCore processor with 4GB RAM.

I'm using tcpreplay to send 780122 packets from a 500 MB pcap file
from a server to my PC, and I'm using pcap_stats() to look at the
statistics of packets received.

My program contains the pcap_loop function that calls the callback
function, which in turn calls another function, FunctionA that
processes the incoming packets. The pcap_stat function is called when
I terminate the program using Ctrl-C, and it'll display the number of
packets dropped and received. In my callback function, I have a
counter to keep track of the packets that enter the callback
function.

I'll like to know what are the significance of ps.recv and ps.drop?
Are they statistics of packets received by the NIC? Does ps.drop count
packets dropped before pcap_loop is even called, or when
callback_function is called, or when FunctionA is called? What about
ps.recv? Why do my counter and ps.recv show different values? I
noticed that when I receive packets from the pcap file, I always get
twice the number of packets (shown by ps.recv). For example, the pcap
file contains 780122 packets, and for some reason I can only receive a
maximum of 780049 packets, and ps.recv will return 1560098. This is
the same for other pcap files. Why is that?

Also, when I send just one 500 MB pcap file to my PC at a relatively
high speed (~700 Mbps), I encounter no dropped packets. However, if I
loop the pcap file multiple times at the same speed, I'll get dropped
packets. Is this a sign of running out of buffer space (kernel, NIC?),
or is FunctionA simply not fast enough? Would a low CPU utilization
rate coupled with dropped packets point more towards a lack of buffer
space?

I've also come across rmem_default and rmem_max. Are they parameters
for setting the (kernel?) buffer space for the packets? What is a good
size for rmem_default and rmem_max if I'm receiving packets at speeds
over 700 Mbps?

Finally, are there any tutorials online that would explain how a
packet is transferred from wire to the function where it's processed,
and why packets are dropped?

Thank you.

Regards,
Rayne
 
Reply With Quote
 
 
 
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
blocking packets which come we get from pcap application tapankulkarni@gmail.com Linux Networking 2 02-27-2006 03:39 AM
Win Pcap will it cause network problems? Eric Home Networking 1 02-07-2006 10:00 AM
filter pcap files Matt Linux Networking 2 05-20-2005 02:38 AM
pcap file help jly Linux Networking 1 05-27-2004 11:27 PM
pcap filters outgoing packets Johny Franslay Linux Networking 0 04-22-2004 02:08 AM



1 2 3 4 5 6 7 8 9 10 11