Re: AIX BPF Buffer Size

[Shaun <delius () progsoc uts edu au>]

> > I notice that on AIX during the BPF buffer size selection loop (BIOCSBLEN)
> > the buffer size ends up being around 16k. For those of us who aren't
> > particularly familiar with the buffers used on other platforms is this
> > small a value normal?
>
> The BPF code starts at 32K and keeps trying smaller sizes, dividing by
> half, until it's allowed to do a BIOCSBLEN and a BIOCSETIF to set the
> size to the specified value.

Yeah, it's somewhat frustrating that that ends up a miniscule 16k though.

> If it ends up being around 16K, that means that 32K doesn't work and 16K
> does; perhaps that's all the buffering AIX lets you have.

I played with the loop and made it decrement by 1k each iteration and that
was the max allowed.

> > By my calculations this space will be filled about
> > 78 times a second on a busy 10MB Ethernet. How can I hope to keep up with
> > the traffic on the network at this sort of rate?
>
> By reading from the buffer 78 or more times a second.  That requires
> that you take less than ~.0128 seconds to handle 16K worth of packets,
> including waking up, reading the packets, and processing them.

That's the bit that bothers me, on a decent system I could easily motor
through processing gobs of data in a second, it's the syscall and sleep
overhead that will kill me.

> All that
> a bigger buffer does is reduce the amount of time spent doing wakeups
> and per-system-call overhead for reads, by letting you do fewer reads.

And allow you to go off and do something else for a short time as long as
you come back reasonably soon and process quickly when you do.

Do the other libpcap platforms typically provide similarly limited buffer
space for packets?

Thanks,
Shaun

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe