Subject: Re: IFQ_MAXLEN: How large can it be?
To: Steven M. Bellovin <>
From: Christoph Kaegi <>
List: tech-net
Date: 11/17/2006 08:02:54
On 16.11-12:57, Steven M. Bellovin wrote:
> On Thu, 16 Nov 2006 17:05:17 +0100, Christoph Kaegi <> wrote:
> The question, then, is which interface the dropped packets are coming
> from.  They all end up in one IP input queue.  And if the CPU is that
> idle, I'm quite perplexed.  Catching it in the act of dropping packets
> might be necessary -- watch for CPU load at the time, and also input
> packet counts on those four interfaces.

OK, I'll try to graph CPU Load and input/output packets now.
For input/output packets I can use netstat -ni, how would I
go about getting CPU load every second? 
How should I interpret sysctl kern.cp_time?

Or can you point me to some useful C functions so I could write and 
run a programm which outputs the relevant values every second?

Christoph Kaegi