Wireshark-users: Re: [Wireshark-users] Can dumpcap show dropped packets statistics ?
Jeff Morriss wrote:
(AFAIK the number of dropped packets is whatever the capture
mechanism--libpcap or WinPCAP--tells it.)
...and if you have libpcap on Linux, and it wasn't built with support
for the PACKET_STATISTICS getsockopt() operation, it can't find out how
many packets were dropped by the capture socket, and will report 0 as
the number of dropped packets.
I don't know whether the libpcap in FC4 is built with that support or
not; the configure script should detect whether the <linux/if_packet.h>
structure defines the tpacket_stats structure and, if so, enable support
for the PACKET_STATISTICS getsockopt() operation.