[Bro] Question about capture loss script vs. broctl netstats

Derek Banks itsecderek at gmail.com
Thu Jun 27 11:21:34 PDT 2013


Thanks for all the responses.  I put an Intel Pro 1000 in this morning and
still using PF_Ring.  I three hours of running Bro, I don't see any
reported packet loss.  Looks like the Broadcom Card was most likely the
problem.

-Derek


On Thu, Jun 27, 2013 at 2:17 PM, Seth Hall <seth at icir.org> wrote:

>
> On Jun 27, 2013, at 9:09 AM, Vern Paxson <vern at icir.org> wrote:
>
> >  (Also, some kernels have bugs in how these
> > statistics are captured, for example missing out on packets dropped by
> > the NIC rather than the kernel.)
>
>
> Since you're using a DAG card this could depend on what sort of flow
> splitting configuration you have in place there too.
>
>   .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130627/b4e55906/attachment.html 


More information about the Bro mailing list