Warning about userland filtering always appears

[klaus3000]

I receive the detected non-fatal error during pcap activation, filters may run in userland [11]: Resource temporarily unavailable warning also when using short filters which do not cause any libcap warnings.

Setting statistics interval to: 60
BPF program is: (net 11.22.32.98/32 or net 2a02:fff:4:4::98/128 or net 11.22.32.103/32 or net 2a02:fff:4:4::103/128) and (udp port 53 or tcp port 53)
Opening interface eth1
Opening interface eth2
creating dataset qtype
...
writing PID to /var/run/regdns.dsc.pid
detected non-fatal error during pcap activation, filters may run in userland [11]: Resource temporarily unavailable
Running

[jelu]

Seen this also on all Linux based platforms, FreeBSD and OpenBSD does not report this. Might be that Linux actually does not support BPF on the interface that pcap opens, will look at it when I have time.

[aabdnn]

FYI: I have just seen the same thing on our server, running CentOS 7.

[SvenVD]

Does it mean capturing fails?

[jelu]

No, not directly. If filtering is not done at kernel level and your receiving a lot of packets that are meant to be filtered it may have a huge impact on processing when it's filtered higher up. That may lead to drops that would not happen if it was done at kernel level.

[SvenVD]

Any idea when this will be fixed? I did not have this warning with the same bpf filter but with the older dsc collector (2012 ish) on CentOS 6

For the record, I am now getting this warning on a CentOS 7 with the latest dsc rpm collector

Thanks

[jelu]

The warning did not exist before, it is new and it can't be fixed in DSC because it's a matter of what kernel API are available for libpcap. It is just a warning, it's not fatal and if your filters are the same then operational wise it is the same as before. The warning does not appear on UNIX systems that have the right support for kernel level filtering such as FreeBSD and OpenBSD. The warning can also appear on these systems if the filter is too large to fit within the kernel, then it's processed in userland.

[SvenVD]

Okay, thanks for this clear explanation