Daniel Borkmann

> Well it seems like that in kernel 5.15, this bug would always shows up. In my ubuntu 2004, kernel 5.4, the system works well. > > It seems to...

Back in the days, there was a kernel bug in rlimit/mlock accounting leading to an underflow with subsequent rejection similar to above: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=003461559ef7a9bd0239bae35a22ad8924d6e9ad Any idea if our 4.9 is affected?

Yes, totally agree, pcap-ng support would be nice.

Thanks for the report, @igvk! Is this always happening at about 3.7GB or rather randomly after a certain amount of time? In other words, how deterministically reproducible is this bug...

@jonschipp what netsniff-ng version are you using? Can you reproduce this with the latest version?

Not sure why you turn gro off and specify ring buffers by yourself, but that should not be the issue probably. Anyway, I'm a bit confused here. So you're saying...

Jon, I currently don't have access to some testing equipment, working on that. What happens if you set in ring_rx.c the following: ``` - ring->layout3.tp_retire_blk_tov = 100; + ring->layout3.tp_retire_blk_tov =...

Ok, thanks for your efforts to track this down Jon! Doesn't gulp use libpcap as well? Anyway, if this problem is not netsniff-ng related anymore, please close that ticket.

Thanks for reporting Jon! How does configs/64.cfg look ? Could you copy its content here ? Is the same issue when you specify -t0 ? What if you leave out...

> * The project must be using eBPF as its underlying core technology: white_check_mark Project Calico is built around our robust eBPF data plane with critical eBPF-only features such as...