Re: high cpu load with tcpdump

[christos%zoulas.com@localhost (Christos Zoulas)]

On Feb 29,  9:11pm, 6bone%6bone.informatik.uni-leipzig.de@localhost (6bone%6bone.informatik.uni-leipzig.de@localhost) wrote:
-- Subject: Re: high cpu load with tcpdump

| On Mon, 29 Feb 2016, Christos Zoulas wrote:
| 
| > | Hello,
| > |
| > | the problem occurs only on one of my servers. I tried to find the
| > | difference. It is the bind9 (bind-9.10.3pl3). If I stop the bind9, tcpdump
| > | works without problems. When I restart the bind9, the CPU load goes back
| > | to 100%.
| > |
| > | Is it a problem of the kernel, tcpdump or bind9?
| >
| > Can you ktrace the bind? Perhaps it is waking up tcpdump spuriously.
| > That would indicate a kernel problem.
| 
| ktrace tcpdump starting at timestamp 1456773618

This tcpdump ktrace is when bind is running, right?
What happens if you stop it? How does the ktrace look then?
Or once you start bind, tcpdump goes nuts and stays that way?

christos