Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This is the way I see it.

A copy of the network activity is written to a buffer, and snoop reads from the buffer. As long as snoop is able to get the data out fast enough (writing directly to a file is faster than writing to a terminal or a bziper), then the buffer will never fill up.

But if there is a high volume of network activity, and snoop can't write it out fast as it comes in (for whatever reason), then snoop has to wait, therefore the original buffer gets full.

If the buffer gets large, what happens?

  • In favor of maximum throughput, the buffer grows, indefinitely. :-/
  • In favor of low memory usage, some data might be excluded. :-o
  • In favor of stable results, the network I/O is bottle-necked until there is more room in the buffer. B-)

I am particularly interested in Solaris, but information on other UNIX systems would be interesting.

share|improve this question
up vote 2 down vote accepted

I think that packets get dropped by snoop in favour of not delaying them during times of high activity.

Snoop provides the -D switch to display the number of packets dropped during capture.

The -s snaplen switch can be used to truncate packet capture after snaplen bytes and means there is less chance of buffer overflow during high traffic periods.

The warnings section of the man page says this too

The processing overhead is much higher for realtime packet interpretation. Consequently, the packet drop count may be higher. For more reliable capture, output raw packets to a file using the -o option and analyze the packets off line.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.