<html><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div dir="ltr" id="yui_3_16_0_1_1412781577035_3568">in the stats file there are 2 values of interest, capture.kernel_packets, capture.kernel_drops. </div><div dir="ltr" id="yui_3_16_0_1_1412781577035_3568"><br></div><div dir="ltr" id="yui_3_16_0_1_1412781577035_3568">I believe that capture.kernel_packets would be the total number of packets for each thread, capture.kernel_drops would be the number of capture.kernel_packets dropped. Hence capture.kernel_packets should always be greater than capture.kernel_drops. However, this does not appear to be the case. We have many instances where the number of capture.kernel_packets is less than capture.kernel_drops. Indicating we are dropping more packets than we receive. <br><br>The question here is what are these two values and how are they derived?</div><div></div></div></body></html>