Re: percentage of traffic captured on monitor interfaces

[Mike Kershaw <dragorn () kismetwireless net>]

abhinav narain <abhinavnarain10 () gmail com> wrote:

I wanted to know how much percentage of the original wireless traffic do I
lose when I am sniffing on monitor interfaces ?
pcap statistics show me no packet loss, but I wanted to know, if the
virtual interfaces( phy{0,1}) itself gave me all the traffic or not.

Ideal case would have been sweeping out the packets from the kernel itself,
but my patch does not work for some reason, hence I am sniffing on monitor
interfaces.

Abhinav
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.


Unless your sniffing hw is vastly underpowered or your code is seriously inefficient, you should see 100% of the 
traffic visible to your sniffing device. 

What percentage of the packets in the air that constitutes is unknowable unless you control all transmitters and can 
correlate. Packet loss in the air can happen due to localized interference, reflection, multipath fade, and crummy 
drivers. A transmitter in range of the sniffer can cause interference not necessarily visible to the original 
transmitter and receivers. 
-- 
Sent from mobile, brevity, accuracy and security disclaimers. -
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.