Hello,
I have a question about libpcap library with Gigabit Ethernet. I have
seen several discussions
about Ethereal in the context of Gigabit ethernet which is also based on
libcap, and hence I
am asking a couple of questions here:
a) I have read in a paper (by Luca Deri) that a basic packet capture loop:
pcap_open(); while(1) { captureAndDiscard(); } pcap_close() can handle
Gigabit speed without
any packet loss [assuming sufficiently fast processor]. There is no
filter set.
So the question is the does packet loss (or rather
lack of it) depend on size of caplen? In other words, if I set caplen
higher then does the probability
of packet loss increase?
2) If full-packet (caplen=1514) capture on a Gigabit interface results
in loss, then does setting a filter (for instance only packets for one
particular host) enable full-packet capture *without* any packet loss
(at least with very very low loss)? In other words, does setting filter
have any effect on packet loss with caplen set to 1514?
Thanks much
Dinkar.