[Bro] Question about capture loss script vs. broctl netstats
Derek Banks
itsecderek at gmail.com
Thu Jun 27 11:21:34 PDT 2013
Thanks for all the responses. I put an Intel Pro 1000 in this morning and
still using PF_Ring. I three hours of running Bro, I don't see any
reported packet loss. Looks like the Broadcom Card was most likely the
problem.
-Derek
On Thu, Jun 27, 2013 at 2:17 PM, Seth Hall <seth at icir.org> wrote:
>
> On Jun 27, 2013, at 9:09 AM, Vern Paxson <vern at icir.org> wrote:
>
> > (Also, some kernels have bugs in how these
> > statistics are captured, for example missing out on packets dropped by
> > the NIC rather than the kernel.)
>
>
> Since you're using a DAG card this could depend on what sort of flow
> splitting configuration you have in place there too.
>
> .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130627/b4e55906/attachment.html
More information about the Bro
mailing list