packets dropped by kernel on host node management nic

[WXR <14...@qq.com>]

I use cloudstack4.1 basic network.
When I use tcpdump to capture packets on the management nic of the host node,it will be like this:

[root@cs-kvm02 opt]# tcpdump -c 10000 -w /test.pcap -vv
tcpdump: listening on cloudbr0, link-type EN10MB (Ethernet), capture size 65535 bytes
10000 packets captured
10515 packets received by filter
481 packets dropped by kernel

I don't know if it is normal,I think it should be "0 packets dropped by kernel".

Re: packets dropped by kernel on host node management nic

[David Nalley <da...@gnsa.us>]

On Fri, Jul 19, 2013 at 9:42 PM, WXR <14...@qq.com> wrote:
> I use cloudstack4.1 basic network.
> When I use tcpdump to capture packets on the management nic of the host node,it will be like this:
>
> [root@cs-kvm02 opt]# tcpdump -c 10000 -w /test.pcap -vv
> tcpdump: listening on cloudbr0, link-type EN10MB (Ethernet), capture size 65535 bytes
> 10000 packets captured
> 10515 packets received by filter
> 481 packets dropped by kernel
>
> I don't know if it is normal,I think it should be "0 packets dropped by kernel".

So tcpdump has a buffer, and if tcpdump doesn't clear the buffer fast
enough - the kernel will overwrite the buffer and 'drop packets'
See the tcpdump manpage for more information.

--David