# about

**URL:** <https://community.zeek.org/t/about/335>\
**Category:** Zeek\
**Created:** [January 4, 2003, 7:31am UTC](https://community.zeek.org/t/about/335 "2003-01-04T07:31:38Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [January 4, 2003, 7:31am UTC](https://community.zeek.org/t/about/335/1 "2003-01-04T07:31:38Z")

</div>

> &nbsp;&nbsp;You could also just watch the variable 'drop' returned by pcap\_stats(  
> ) to see if there are drops.

Yes, but only on some systems, and for some types of drops. As you mention,  
on some systems it's not accurate, due to kernel bookkeeping deficiencies,  
or because loss occurs on the NIC (which can't always correctly report it)  
or at the tap rather than in the kernel.

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:36pm UTC](https://community.zeek.org/t/about/335/2 "2022-05-06T15:36:41Z")

</div>