From 2032d3522861c8dcf335546b10ffa6f51f3c2497 Mon Sep 17 00:00:00 2001 From: Guy Harris Date: Mon, 7 Sep 2009 16:23:15 -0700 Subject: From Dustin Spicuzza: support ps_ifdrop on Linux, using /proc/net/dev. Fix the title of the pcap_stats man page, and give more detail - and a lot of caveats. --- pcap_stats.3pcap | 48 ++++++++++++++++++++++++++++++++++++++++++++---- 1 file changed, 44 insertions(+), 4 deletions(-) (limited to 'pcap_stats.3pcap') diff --git a/pcap_stats.3pcap b/pcap_stats.3pcap index abc56f8..a953e21 100644 --- a/pcap_stats.3pcap +++ b/pcap_stats.3pcap @@ -19,7 +19,7 @@ .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. .\" -.TH PCAP_SNAPSHOT 3PCAP "5 April 2008" +.TH PCAP_STATS 3PCAP "7 September 2009" .SH NAME pcap_stats \- get capture statistics .SH SYNOPSIS @@ -35,17 +35,57 @@ int pcap_stats(pcap_t *p, struct pcap_stat *ps); .SH DESCRIPTION .B pcap_stats() fills in the -.I pcap_stat -structure pointed to by its second argument. The values represent +.B struct pcap_stat +pointed to by its second argument. The values represent packet statistics from the start of the run to the time of the call. .PP .B pcap_stats() is supported only on live captures, not on ``savefiles''; no statistics are stored in ``savefiles'', so no statistics are available when reading from a ``savefile''. +.PP +A +.B struct pcap_stat +has the following members: +.RS +.TP +.B ps_recv +number of packets received; +.TP +.B ps_drop +number of packets dropped because there was no room in the operating +system's buffer when they arrived, because packets weren't being read +fast enough; +.TP +.B ps_ifdrop +number of packets dropped by the network interface or its driver. +.RE +.PP +The statistics do not behave the same way on all platforms. +.B ps_recv +might count packets whether they passed any filter set with +.BR pcap_setfilter (3PCAP) +or not, or it might count only packets that pass the filter. +It also might, or might not, count packets dropped because there was no +room in the operating system's buffer when they arrived. +.B ps_drop +is not available on all platforms; it is zero on platforms where it's +not available. If packet filtering is done in libpcap, rather than in +the operating system, it would count packets that don't pass the filter. +Both +.B ps_recv +and +.B ps_drop +might, or might not, count packets not yet read from the operating +system and thus not yet seen by the application. +.B ps_ifdrop +might, or might not, be implemented; if it's zero, that might mean that +no packets were dropped by the interface, or it might mean that the +statistic is unavailable, so it should not be treated as an indication +that the interface did not drop any packets. .SH RETURN VALUE .B pcap_stats() -returns 0 on success and returns \-1 if there is an error or the +returns 0 on success and returns \-1 if there is an error or if .I p doesn't support packet statistics. If \-1 is returned, -- cgit v1.2.3