> You could also just watch the variable 'drop' returned by pcap_stats( > ) to see if there are drops. Yes, but only on some systems, and for some types of drops. As you mention, on some systems it's not accurate, due to kernel bookkeeping deficiencies, or because loss occurs on the NIC (which can't always correctly report it) or at the tap rather than in the kernel. Vern