<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/css" href="/stylesheets/rss.css"?>
<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:trackback="http://madskills.com/public/xml/rss/module/trackback/">
  <channel>
    <title>loopkid: tcpdump: packets dropped by kernel</title>
    <link>http://loopkid.net/articles/2008/06/25/tcpdump-packets-dropped-by-kernel</link>
    <language>en-us</language>
    <ttl>40</ttl>
    <description>sad songs make me happy</description>
    <item>
      <title>tcpdump: packets dropped by kernel</title>
      <description>&lt;p&gt;tcpdump is a really nice tool, but it may render useless with it&amp;#8217;s default settings.&lt;/p&gt;

&lt;pre&gt;&lt;code&gt;$ sudo tcpdump -i en1
&lt;/code&gt;&lt;/pre&gt;

&lt;p&gt;In my case led to&lt;/p&gt;

&lt;pre&gt;&lt;code&gt;80 packets captured
7705 packets received by filter
6794 packets dropped by kernel
&lt;/code&gt;&lt;/pre&gt;

&lt;p&gt;To solve the issue I had to turn off address translation.&lt;/p&gt;

&lt;pre&gt;&lt;code&gt;$ sudo tcpdump -i en1 -n
&lt;/code&gt;&lt;/pre&gt;

&lt;p&gt;Now the results look as expected.&lt;/p&gt;

&lt;pre&gt;&lt;code&gt;6941 packets captured
7011 packets received by filter
0 packets dropped by kernel
&lt;/code&gt;&lt;/pre&gt;</description>
      <pubDate>Wed, 25 Jun 2008 09:49:00 +0200</pubDate>
      <guid isPermaLink="false">urn:uuid:169ab5cb-2ba5-4fc8-952d-04ee4782e17b</guid>
      <author>Stefan</author>
      <link>http://loopkid.net/articles/2008/06/25/tcpdump-packets-dropped-by-kernel</link>
      <category>English</category>
      <category>Mac OS X</category>
      <category>Linux</category>
      <trackback:ping>http://loopkid.net/articles/trackback/8350</trackback:ping>
    </item>
  </channel>
</rss>
