How do I limit packet loss when sniffing a network?

Hits: 2697 Rating:

(3.35) votes 1957
Rate: 1-star 2-stars 3-stars 4-stars 5-stars
E-mail this PC Troubleshooting FAQ to a friend

E-mail to a friend save

Bookmark this PC Troubleshooting FAQ

Answer:

If you're experiencing a lot of packet loss, you may want to limit the scope of the packets read by using filters. This will only work if the filtering is done before any buffering. If this still doesn't work because your packet capturing facility is broken like NIT, you'll have to read the packets faster in a user process and send them to another process -- basically attempt to do additional buffering in user space.

Another way of improving performance, is by using a larger buffer. On Irix using SNOOP, the man page recommends using SO_RCVBUF. On BSD with BPF one can use the BIOCSBLEN ioctl call to increase the buffer size. On Solaris bufmod and pfmod can be used for altering buffer size and filters respectively.

Remember, the longer your process is busy and not attending the incoming packets, the quicker they'll be dropped by the kernel.