Subject: Re: effect of tcpdump on mbufs
To: Darren Reed <email@example.com>
From: Bill Sommerfeld <firstname.lastname@example.org>
Date: 01/13/2000 11:11:52
> If I run tcpdump on an interface and then stop it and leave it there for
> an hour or two, will this have an adverse effect on mbufs ?
bpf does its own buffering and copies data out of mbufs at tap time;
it doesn't queue mbufs for the bpf reader process.
If the reader falls behind, packets get dropped (and a drop counter,
readable through the BIOCGSTATS ioctl, gets incremented).