Going through the man page of tcpdump, it seems kernel can drop the packets if the buffer is full. I was wondering if:that size is configurable and/orwhere can I see the size for my distro?From the man page (for easy reference):packets ``dropped by kernel'' (this is the number of packets that were dropped, due to a lack of buffer space, by the packet capture mechanism in the OS on which tcpdump is running, if the OS reports that information to applications; if not, it will be reported as 0).
Buffer size for capturing packets in kernel space?
kernel;networking;buffer;tcpdump