48

I interrupted tcpdump with Ctrl+C and got this total summary:

579204 packets captured
579346 packets received by filter
142 packets dropped by kernel

What are the "packets dropped by kernel"? Why does that happen?

  • In my case i was using option -s0, changing it to -s1600 (right above MTU) solved it for me. – LatinSuD Nov 9 '17 at 12:48
47

From the tcpdump's manual:

packets ``dropped by kernel'' (this is the number of packets that were dropped, due to a lack of buffer space, by the packet capture mechanism in the OS on which tcpdump is running, if the OS reports that information to applications; if not, it will be reported as 0).

A bit of explanation:

The tcpdump captures raw packets passing through a network interface. The packets have to be parsed and filtered according to rules specified by you in the command line, and that takes some time, so incoming packets have to be buffered (queued) for processing. Sometimes there are too many packets, they are saved to a buffer, but they are saved faster than processed, so eventually the buffer runs out of space, so the kernel drops all further packets until there is some free space in the buffer.

You can increase the buffer size with the -B (--buffer-size) option like this:

tcpdump -B 4096 ....

Note that the size is specified in kilobytes, so the line above sets the buffer size to 4MB.

  • 1
    Also I intentionally changed kibi-/mebi- to kilo-/mega- and omitted a word about libpcap in order to not confuse people. – Dmitry Vasilyanov Jul 16 '14 at 11:09
  • 4
    Note also that support for "long options" in tcpdump is relatively new; in older versions (except for much older versions, which don't support setting the buffer size) you can do tcpdump -B 4096. – user44841 Jul 17 '14 at 0:08
24

One more thing to consider/try is that tcpdump may be spending a lot of time doing DNS queries to resolve IPs to domain names. If you don't need those, try throwing in the -n (no lookups) flag. e.g.:

tcpdump -n port 80
  • 1
    This was a savior. Didn't realize tcpdump did reverse resolution when dumping to a file!! Using -nn -B 4096 allowed me to get 0 packets dropped by kernel – Blanka Dec 13 '17 at 22:57
10

According to man tcpdump:

packets dropped by kernel (this is the number of packets that were dropped, due to a lack of buffer space, by the packet capture mechanism in the OS on which tcpdump is running, if the OS reports that information to applications; if not, it will be reported as 0).

The kernel puts captured packets in a fixed-size capture buffer. If tcpdump doesn't empty that buffer quickly enough, the kernel will begin overwriting old packets in the buffer and correspondingly incrementing the dropped counter. The value of that counter is what you see as "dropped by kernel".

By the way, you can resize the capture buffer: Pass tcpdump the -B option with a KiB size.

2

Besides what the man page says, there appears to be some additional reason why packets may be dropped by the kernel. I was experiencing 100% packet drop from tcpdump where the only traffic on the network was one 512B packet of PRBS per second. Clearly the buffer space explanation doesn't make sense here - I think the kernel can handle 0.5kiB/s.

Something that came along with my distro (Ubuntu 14.04) may have been doing some sort of smart filtering at the link layer that didn't like my test packets. My workaround was to create a new network namespace as follows:

sudo -i
ip netns add debug
ip link set dev eth0 netns debug
ip netns exec debug bash
ifconfig eth0 1.2.3.4 up

In the inner netns shell, whatever OS processes that were causing problems before are out of the picture and tcpdump shows me all of the packets I expect to see.

0

I find useful using the tcpdump -c option. This way you can set the number of packets and then stop and you cannot fill out the buffer.

For instance this one will capture the tcp requests on localhost.

tcpdump -ni lo tcp -c 20

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.