I am working on an embedded system with limited memory. Here is the dump from my vmstat:
procs -----------memory---------- ---swap-- -----io---- -system-- ------cpu-----
r b swpd free buff cache si so bi bo in cs us sy id wa st
1 0 0 2392 64392 46568 0 0 0 3 53 22 27 9 64 0 0
When I run tcpdump in this situation, the whole system crashes and the OOM killer goes crazy. Given the large amount of memory still sitting in the cache, what could be causing this? What does tcpdump do that uses up so much memory, and why does the kernel let this happen?