[dsc] Duplicate packets captured

[Anand Buddhdev]

Hello DSC users,

We've noticed a strange issue with our DSC installation. We have a
CentOS 6 server, with libpcap 1.0.0 (part of the base CentOS
installation). We run multiple collectors, with configurations like these:

interface eth0;
local_address 193.0.9.X;
local_address 2001:67c:e0::X;
bpf_program "host 193.0.9.X or host 2001:67c:e0::X";
run_dir "/export/dsc/data.X";
pid_file "/var/run/dsc.X.pid";
minfree_bytes 5000000;

We run the collector like this: "dsc -f /etc/dsc.X.conf". We are not
using the "-p" option.

We know from our BIND server stats and from interface packet counts that
this server receives about 20,000 q/s in total to its various IP
addresses. However, our DSC graphs show this server as receiving over
70,000 q/s. The pcap_stats.dat files show:

1373241600 filter_received eth0:1116957 pkts_captured eth0:1064507
kernel_dropped eth0:52454
1373241660 filter_received eth0:1170577 pkts_captured eth0:1086713
kernel_dropped eth0:83863
1373241720 filter_received eth0:1179544 pkts_captured eth0:1114259
kernel_dropped eth0:65283

In comparison, on a similar box, which also receives about 20,000 q/s,
and with identical configuration for the collectors, the graphs show an
accurate query rate. Also, the pcap_stats.dat files show:

1373241600 filter_received eth0:28470 pkts_captured eth0:28470
1373241660 filter_received eth0:24789 pkts_captured eth0:24788
1373241720 filter_received eth0:28389 pkts_captured eth0:28385

Has anyone else experienced this phenomenon where the dsc collector is
counting packets more than once, and exaggerating the query rates? If
so, is it a libpcap issue or bug? Is there any known work-around?

Regards,

Anand