OS: Centos7
I disabled interrupt moderation,
ethtool -C eno2 rx-usecs 0,
and then started capturing on that interface using tcpdump. The dump file was growing as expected.
Maybe an hour later the tcpdump process was still running, and I could see the interface was receiving packets (via ifconfig) but the packets were no longer being captured by tcpdump.
I stopped tcpdump (showed no drops) & started again, but still no packets were being captured, even though ifconfig was showed the interface was still receiving packets.
So I enabled interrupt moderation,
ethtool -C eno2 rx-usecs 20,
and started tcpdump again... packets were being captured.
I then disabled interrupt moderation, started tcpdump again, and packets were still being captured. Checked back some time later and the same problem had occurred... no packets were being captured - even though the interface was receiving packets.
I noticed that ifconfig showed that the 'NIC' had dropped an additional packet each time I realized packets were no longer being captured.
Any help would be great.
Thanks.
