Thor Lancelot Simon <tls%panix.com@localhost> writes: > On Thu, Oct 27, 2011 at 07:55:16PM +0200, Manuel Bouyer wrote: >> The mbuf passed to the adapter is also passed to bpf_mtap(), >> so bpf_mtap() gets the tso packet and not the on-wire packets when >> tso is in use. >> >> AFAIK bpf_mtap() doesn't do any attempts at doing something special >> with TSO mbufs it could get. So I guess tcpdump is getting the TSO >> buffer ... > > ...which should frequently exceed the MTU, shouldn't it? So I would > actually expect tcpdump to misbehave. Perhaps, but bpf doesn't know about the interface MTU, and has its own snaplen of how much, so if it is seeing a 32 KB TCP packet then that should be ok. But I saw no such packets in the trace.
Attachment:
pgpr2NBYdRvMB.pgp
Description: PGP signature