On Tue Jan 13 2004 at 15:59:20 -0500, Steve Bellovin wrote:
> http://luca.ntop.org/Ring.pdf gives some interesting insights into 
> packet capture architectures.  I knew that stock systems didn't do very 
> well; I'm astonished at how poorly they do at monitoring a network.

Yes, indeed.  I've been using pcap for an application on a fairly loaded
network on linux for some time now.  It's good to know it shouldn't work
as well as it does ;)

My guess is that the network load there is falling short of the lossage
threshold, although probably not by very much.

Interesting insights anyhow, thanks for the pointer.

-- 
Antti Kantee <pooka@iki.fi>                     Of course he runs NetBSD
http://www.iki.fi/pooka/                          http://www.NetBSD.org/
                 "connoisseurs do not chill their malts."