Subject: Re: effect of tcpdump on mbufs
To: Darren Reed <>
From: Bill Sommerfeld <>
List: tech-net
Date: 01/13/2000 11:11:52
> If I run tcpdump on an interface and then stop it and leave it there for
> an hour or two, will this have an adverse effect on mbufs ?


bpf does its own buffering and copies data out of mbufs at tap time;
it doesn't queue mbufs for the bpf reader process.

If the reader falls behind, packets get dropped (and a drop counter,
readable through the BIOCGSTATS ioctl, gets incremented).

					- Bill