The kernel has a buffer for packets to be delivered to tcpdump. If tcpdump doesn't respond quickly enough, the kernel will overwrite old packets with new ones.
使用tcpdump抓包時，核心分配緩衝區存放向tcpdump傳送的資料包，如果tcpdump處理的不夠快，新到達的包會覆蓋緩衝區中較早的包，即出現dropped丟包的情況。
解決方法：

1. 增大系統緩衝區大小 bpfbufsize

2. 避免tcpdump進行dns解析，使用tcpdump -n引數。儘量減少tcpdump的工作量，其他的引數如-nn等可參考。

Dropped packets

At the end of its run, TCPdump will inform you if any packets were dropped in the kernel. If this becomes a problem, it's likely that your host can't keep up with the network traffic and decode it at the same time. Try using TCPdump's -w option to bypass the decoding and write the raw packets to a file, then come back later and decode the file with the -r

switch. You can also try using -s to reduce the capture snapshot size.