LINUX.ORG.RU

tcpdump: received > captured


0

2

Как такое может быть?

52 packets captured

54 packets received by filter

0 packets dropped by kernel

Я так понимаю, если есть фильтр, то второе может быть меньше первого. Но как оно может быть больше? В любом случае, фильтра нет.

В общем, есть подозрение, что tcpdump теряет пакеты. Как от этого избавиться?



Последнее исправление: Dims2000 (всего исправлений: 1)

Я так понимаю, если есть фильтр, то второе может быть меньше первого. Но как оно может быть больше? В любом случае, фильтра нет.

man tcpdump:

    packets ``captured'' (this is the number of packets that tcpdump has received and processed); 
    packets ``received by filter'' (the meaning of this depends on the OS on which you're running tcpdump, and possibly on the way the OS was configured - if a filter was specified on the command line, on some OSes it counts packets regardless of whether they were matched by the filter expression and, even if they were matched by the filter expression, regardless of whether tcpdump has read and processed them yet, on other OSes it counts only packets that were matched by the filter expression regardless of whether tcpdump has read and processed them yet, and on other OSes it counts only packets that were matched by the filter expression and were processed by tcpdump); 

edigaryev ★★★★★
()
Вы не можете добавлять комментарии в эту тему. Тема перемещена в архив.