tgs> Alan Cox wrote:
>> > So... BPF samples the packets before they hit the ethernet on the
>> local > machine, isn't that right? And therefore, tcpdump on the local
>> machine
>>
>> Yes but they may still be lost because the ethernet is full so they fall
>> out of the send queue. That isnt infinite either.
>>
tgs> I'm not sure if I understand this right. Once a packet leaves the TCP
tgs> layer and it can not be passed to the ethernet hardware immediately,
tgs> the packet is not buffered, it is discareded?! Is that right? Why can
tgs> it not stay in some sk_buff list? When there is no more system memory
tgs> available, then the send system call will block and therefore there
tgs> should be always enaugh memory to buffer the packet for a wile.
http://paramount.ind.wpi.edu/~rasmusin/papers/congavoid.ps.gz
-- Frank Sweetser rasmusin at wpi.edu fsweetser at blee.net | PGP key available paramount.ind.wpi.edu RedHat 5.2 kernel 2.2.5 i586 | at public servers > A 386sx16 with 3M of ram is noticeable slower than a PPro200 with 256MB of > ram Film at 11. Linus- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/