>Number:         29126
>Category:       bin
>Synopsis:       tcpdump leads to packet loss
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    bin-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Jan 26 14:03:00 +0000 2005
>Originator:     Zafer Aydogan
>Release:        2.99.15
>Organization:
>Environment:
2.99.15 GENERIC i386
>Description:
Starting tcpdump with or without arguments leads to heavy packet loss, (like freezing all connections, up to 15 seconds) until the first packets are seen on the screen from the dump. During dump flow, no packet loss is detected, but same scenario happens if you stop tcpdump with CTRL-C. Again heavy packet loss. This can lead to break established connections (ssh for example). Maybe this is NIC related. I'm using an ex0 (3com 3c905 txm) Network Card. Verified on 2.99.10 and 2.99.15.




>How-To-Repeat:
open a ssh connection to another host. on this host display top with one second delay. now start tcpdump on your local machine and watch the time from top. time stops until tcpdump start printing packets. time stops again when stopping tcpdump.
 

>Fix: