Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am migrating a packet sniffing project from a Dell PowerEdge R410 (with dual Broadcom 1Gb integrated NICs) to a Dell PowerEdge R620 (with quad Intel 1521 i350-series 1Gb daughterboard NICs). I am running the exact same code on the same OS (Debian Squeeze) on both systems. I'm experiencing a problem on the R620 where libpcap is able to retrieve all packets from the Intel NIC, but our software cannot get them from libpcap callback quickly enough and are dropped. The R410 does not report any dropped packets in this same scenarkio. Is it possible that there is a NIC driver setting or flag that could cause such behavior on the Intel NIC? Has anyone else experienced this sort of problem and have any insights on how to go about fixing it?

Also, as a sanity check test, I downloaded and used Tim Carsten's example sniffex.c program (http://www.tcpdump.org/pcap.html) and ran it on both machines. The R410 did not lose packets, but the R620 did.

share|improve this question

migrated from stackoverflow.com Feb 11 '13 at 20:22

This question came from our site for professional and enthusiast programmers.

There's a bunch of interrupt coalescing code for the intel nic which can cause this problem as you're not being fed the packets in small enough chunks to process. Try setting the InterruptThrottleRate, RXIntDelay and RXAbsIntDelay (they're per port settings) –  Petesh Feb 11 '13 at 17:07
@Petesh's answer sounds compelling. Does that help you at all? –  ÃŁŁǫǛȉЖΦΤїҪ Feb 11 '13 at 20:42
I took another look at the Intel driver (version 4.1.2) and found the InterruptThrottleRate. I could not find the RXIntDelay and RXAbsIntDelay parameters. I adjusted the InterruptThrottleRate up, down, and even turned it off but I am still losing packets. –  bbs_chad Feb 11 '13 at 21:53
InterruptThrottleRate=0,0,0,0 is the tunable to use (based on intel.com/support/network/adapter/pro100/sb/CS-032498.htm). Does tcpdump miss the packets? Have you checked interrupt allocation for the i350 driver? –  Petesh Feb 12 '13 at 11:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.