From Bugzilla Helper: User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ja; rv:1.8.1.13) Gecko/20080311 Firefox/2.0.0.13 Description of problem: When the tcpdump command execution completes, it indicates the value of captured, filtered and dropped. If no packets drops, the value of captured and filtered may be equal. But the value of filtered is always double as many as captured in tcpdump-3.9.4-11.el5. I think this is the bug of libpcap-0.9.4 in tcpdump-3.9.4 and fixed in the libpcap-0.9.5. Please see the changelog of the tcpdump community. --- quoted from http://www.tcpdump.org/libpcap-changes.txt --- Don't double-count received packets on Linux systems that support the PACKET_STATISTICS getsockopt() argument on PF_PACKET sockets. -------------------------------------------------------------- Version-Release number of selected component (if applicable): tcpdump-3.9.4-11.el5 How reproducible: Always Steps to Reproduce: 1. execute tcpdump commands. Actual Results: # tcpdump <snip> 736 packets captured 1473 packets received by filter 0 packets dropped by kernel Expected Results: # tcpdump <snip> 736 packets captured 736 packets received by filter 0 packets dropped by kernel Additional info:
Created attachment 302587 [details] don't double-count received packets
This request was evaluated by Red Hat Product Management for inclusion in a Red Hat Enterprise Linux maintenance release. Product Management has requested further review of this request by Red Hat Engineering, for potential inclusion in a Red Hat Enterprise Linux Update release for currently deployed products. This request is not yet committed for inclusion in an Update release.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2009-0114.html