Re: high cpu load with tcpdump

[christos%zoulas.com@localhost (Christos Zoulas)]

On Feb 29,  2:48pm, 6bone%6bone.informatik.uni-leipzig.de@localhost (6bone%6bone.informatik.uni-leipzig.de@localhost) wrote:
-- Subject: Re: high cpu load with tcpdump

| On Sat, 27 Feb 2016, 6bone%6bone.informatik.uni-leipzig.de@localhost wrote:
| 
| > Date: Sat, 27 Feb 2016 23:52:24 +0100 (CET)
| > From: 6bone%6bone.informatik.uni-leipzig.de@localhost
| > To: Joerg Sonnenberger <joerg%britannica.bec.de@localhost>
| > Cc: current-users%netbsd.org@localhost
| > Subject: Re: high cpu load with tcpdump
| > 
| > On Sat, 27 Feb 2016, Joerg Sonnenberger wrote:
| >
| >> fstat should tell you what the file descriptor is, I just want to
| >> identify what device seems to have the trouble.
| 
| Hello,
| 
| the problem occurs only on one of my servers. I tried to find the 
| difference. It is the bind9 (bind-9.10.3pl3). If I stop the bind9, tcpdump 
| works without problems. When I restart the bind9, the CPU load goes back 
| to 100%.
| 
| Is it a problem of the kernel, tcpdump or bind9?

Can you ktrace the bind? Perhaps it is waking up tcpdump spuriously.
That would indicate a kernel problem.

christos