Packets get counted twice during capture. This fixes it. --- ./pcap-linux.c.orig 2005-11-01 22:05:26.000000000 +0100 +++ ./pcap-linux.c 2005-11-01 22:13:26.000000000 +0100 @@ -797,7 +797,7 @@ * getsockopt(handle->fd, SOL_PACKET, PACKET_STATISTICS, .... * resets the counters to zero. */ - handle->md.stat.ps_recv += kstats.tp_packets; + handle->md.stat.ps_recv += kstats.tp_drops; handle->md.stat.ps_drop += kstats.tp_drops; } else