[Bro-Dev] snaplen and drops
robin at icir.org
Thu Oct 27 11:02:43 PDT 2011
On Thu, Oct 27, 2011 at 11:15 -0500, you wrote:
> That's very weird. It's abnormal to get packets > 1514, right? Are
> you monitoring a link with a lot of jumbo packets?
Not at all, but iirc, the kernel reserves spaces for packets of size
snaplen, which means that with larger snaplen, less will fit into its
> Something is wrong, as that small bandwidth shouldn't matter no
> matter what the packet sizes are anyway.
Yeah, I'm thinking so too. Something's odd going on, need to look into
it more closely.
As long as other's aren't seeing similar problems with the default 65K
snaplen, I'm fine.
Robin Sommer * Phone +1 (510) 722-6541 * robin at icir.org
ICSI/LBNL * Fax +1 (510) 666-2956 * www.icir.org
More information about the bro-dev