mozillazg / ptcpdump

Process-aware, eBPF-based tcpdump
MIT License
179 stars 7 forks source link

Report counts when ptcpdump finished capturing packets #34

Closed mozillazg closed 1 month ago

mozillazg commented 1 month ago

Like tcpdump:

When tcpdump finishes capturing packets, it will report counts of:

  • packets ``captured'' (this is the number of packets that tcpdump has received and processed);

  • packets ``received by filter'' (the meaning of this depends on the OS on which you're running tcpdump, and possibly on the way the OS was configured - if a filter was specified on the command line, on some OSes it counts packets regardless of whether they were matched by the filter expression and, even if they were matched by the filter expression, regardless of whether tcpdump has read and processed them yet, on other OSes it counts only packets that were matched by the filter expression regardless of whether tcpdump has read and processed them yet, and on other OSes it counts only packets that were matched by the filter expression and were processed by tcpdump);

  • packets ``dropped by kernel'' (this is the number of packets that were dropped, due to a lack of buffer space, by the packet capture mechanism in the OS on which tcpdump is running, if the OS reports that information to applications; if not, it will be reported as 0).

https://www.tcpdump.org/manpages/tcpdump.1-4.99.4.html