Buffer size for capturing packets in kernel space?
There are several areas you might check to mitigate packets dropped by kernel:
- Look at configuring
/proc/sys/net/core/netdev_max_backlog
and/proc/sys/net/core/netdev_budget
. The default is probably pretty low; try setting each to something like 2000. - Writing to the output device screen may be blocking/slowing the
tcpdump
process long enough to fill the recv buffer- Use
-nn
to turn off DNS lookups and port naming - Write to file instead of the screen
- Try a tool such as gulp
- Use
- If you have a multi-processor machine look at using
taskset
- Use
nice
to set the priority of the process
Even with those settings, it may just be that you can not keep up with the speed of the traffic you are trying to capture. Look at the details of your NIC and machine and ensure that what you expect is even possible.
1) It's configurable but not precisely as it would decide a proper size from your request.
2) Use setsockopt / getsockopt
with SO_RCVBUF / SO_SNDBUF
I'm not familiar with linux but it seems this link explains it well.http://linux.die.net/man/7/socket