From Scott Barron <sb125499@ohiou.edu>: use the

SOL_PACKET/PACKET_STATISTICS "getsockopt()" call, on Linux kernels that
support it, to get packet statistics, so that we can report the number
of dropped packets, and always use <linux/if_packet.h> to get
definitions for PF_PACKET sockets, so that we don't depend on glibc's
header files having been updated to support all the latest shiniest
kernel features (many systems with 2.4[.x] kernels don't have a
<netpacket/packet.h> that defines "struct tpacket_stats", for example,
so we wouldn't have been able to support that kernel feature on those
systems).

1 files changed, 18 insertions, 0 deletions

diff --git a/README.linux b/README.linux
index ecd00e8f..dd959139 100644
--- a/README.linux
+++ b/README.linux
@@ -68,3 +68,21 @@ file says:
 	  Filtering works on all socket types except TCP for now. See the text
 	  file linux/Documentation/networking/filter.txt for more information.
 	  If unsure, say N.
+
+
+Statistics:
+Statistics reported by pcap are platform specific.  The statistics
+reported by pcap_stats on Linux are as follows:
+
+2.2.x
+=====
+ps_recv   Number of packets that were accepted by the pcap filter
+ps_drops  Always 0, this statistic is not gatherd on this platform
+
+2.4.x
+=====
+ps_rec    Number of packets that were accepted by the pcap filter
+ps_drops  Number of packets that had passed filtering but were not
+          passed on to pcap due to things like buffer shortage, etc.
+			 This is useful because these are packets you are interested in
+			 but won't be reported by, for example, tcpdump output.