Subject: Re: 2.6.18-rc6 memory mapped pcap truncates outgoing TCP packets, but not icmp

From: Patrick McHardy <[email-masked]>
Date: Wed, 13 Sep 2006 20:44:21 +0200

bert hubert wrote:
> Hi people,
> 
> I like to use memory mapped pcap (PACKET_MMAP) since off the shelf, linux is
> a tad prone to drop packets while capturing these days. It used to be lots
> better at it, but right now memory mapped pcap is the only way to get things
> working a bit. I've noticed this on many machines.
> 
> However, memory mapped pcap has started to truncate outgoing packets for me
> recently, and interestingly, I only see this with locally generated TCP
> packets, not with locally generated ICMP packets. I haven't yet tried UDP,
> nor actual sniffing, this is all locally generated packets going out on
> eth0.

Are you using TSO on the outgoing device? If so please try to log the
packet using iptables to see if it really is a TSO packet.