full socket buffers

[sthaug at nethelp.no]

> >Snooping/storing traffic would cause high disk I/O and probable influence
> >DHCPD performance. It could be a week before the issue occur :-(
> 
>    We have a sniffer for our DHCP server traffic.  The switch mirrors the traffic of all our DHCP servers to a server dedicated to watching the traffic.  It tends to show us things like rougue servers answering our traffic (when someone inserts a Linksys they bought onto our network with DHCP configured).

We actually run a packet capture on our DHCP servers and store the
results for a few days. It has been invaluable for problem solving,
and has never given us any disk or other load type problems.

Steinar Haug, Nethelp consulting, sthaug at nethelp.no