[snip]
At this point, I remembered Jason Lee's advice to tune the Linux kernel. He suggested this link
http://www.net.t-labs.tu-berlin.de/research/bpcs/
So I did ...
[root@rhyolite bro-1.2.1]# cat /proc/sys/net/core/rmem_default
110592
[root@rhyolite bro-1.2.1]# echo 33554432 > /proc/sys/net/core/rmem_default
[root@rhyolite bro-1.2.1]# echo 33554432 > /proc/sys/net/core/rmem_max
[root@rhyolite bro-1.2.1]# echo 10000 > /proc/sys/net/core/netdev_max_backlog
[root@rhyolite bro-1.2.1]# /sbin/sysctl net.core.rmem_max
net.core.rmem_max = 33554432
OK, this looks like progress. I tried the same tcpdump as above. Now I see ...
121 packets captured
149216 packets received by filter
121673 packets dropped by kernel
Before the 'tune', the kernel was dropping 99.8%. After the tune, it's dropping 81.5%. Not much better. No fair to suggest I drop Linux for FreeBSD!