8

I'm using Ubuntu 14.04 via Virtual Box on a Windows 7 host. The NIC is a USB to Ethernet adapter.

The man for tcpdump states what can cause "packets dropped by kernel" but it doesn't state what causes "packets dropped by interface".

Can anyone shed some light as to why the interface may be dropping packets? Or how I can find out the reason for it dropping the packets?

Gohu
  • 2,064
Adi
  • 91
  • 1
  • 1
  • 8

2 Answers2

10

As you pointed out, there is nothing in the documentation about the "packets dropped by interface" counter. So we need some source code digging.

From the source code of tcpdump, the interface drop counter is extracted from stats.ps_ifdrop:

if (stats.ps_ifdrop != 0) {
    if (!verbose)
        fputs(", ", stderr);
    else
        putc('\n', stderr);
    (void)fprintf(stderr, "%u packet%s dropped by interface\n",
        stats.ps_ifdrop, PLURAL_SUFFIX(stats.ps_ifdrop));

From man pcap_stats:

ps_ifdrop
    number of packets dropped by the network interface or its driver.

And from the libpcap source code:

 *  "ps_ifdrop" is supported. It will return the number
 *  of drops the interface reports in /proc/net/dev,
 *  if that is available.

So the tcpdump "packets dropped by interface" counter corresponds to the packets logged as dropped in /proc/net/dev during the tcpdump capture.

The meaning of the /proc/dev/net fields are explained here

To get a better understanding of the drops, I would start by looking at the following statistics:

  • ethtool -S <interface>
  • grep '' /sys/class/net/<interface>/statistics/*
Gohu
  • 2,064
1

In general, this will be because the computer is too busy to handle the incoming packet, and the interface has no place to put it. The driver may not have given buffers to the interface, the interrupt may be blocked for too long, serious lack of resource issues like that.

This doesn't happen much anymore, as OS implementation and hardware performance have improved, but it was a real issue in the early days, when (for instance) a disk drive might hog the memory bus, or the OS had to give the interface a buffer as part of servicing the receive interrupt (poor hardware design).

stolenmoment
  • 632