Re: AIX BPF Buffer Size

[Shaun <delius () progsoc uts edu au>]

> Are you certain that the system call and sleep overhead will
> *definitely* make it impossible?  If so, then, unless you can coax AIX
> into giving you a bigger buffer, you might be out of luck.

I think I am, testing today showed my dual CPU RS6000 workstation to be
capable or processing a bit less that 1 MegaByte/second before losing
packets. (This is with a pcap modified to do the bpf_load before doing
anything else, to try to avoid the EFAULT problem discussed in our other
thread, it may be that one of the mysterious 'working' combinations is
more efficient than the others).

> I.e., it leaves you more able to handle bursts and temporary slowdowns
> in processing - you obviously still have to be able to retire buffers at
> the same rate that they're supplied in the steady state.

Exactly, but most modern machines can easily churn through megs of data, I
strongly suspect the sleep/wakeup process leads to insufficient turnaround
time for processing, though I can't prove it.

> Linux and IRIX use sockets for capturing - I don't know how big you
> could make a socket buffer.  Linux also gives you *one* packet per read;
> IRIX might do so as well.  Recent Linux kernels support a memory-mapped
> buffer for capturing, but the standard libpcap doesn't yet support that.

Maybe I have other problems then (wouldn't be half surprised, BPF on AIX
seems to be flaky indeed), my Linux box easily handled over 1MB of
data/second (though I haven't tested the upper limit yet). I think I'll
have to give DLPI a go and see how it performs.

> Solaris and HP/UX use DLPI (and AIX can be configured to do so); the
> "chunk size" on Solaris, which is the maximum amount of data you get per
> read, is limited to 64K, but I don't know what the stream head limit is,
> so I don't know how many chunks can be stored at the stream head.  HP-UX
> and AIX's DLPIs do no chunking, so you get one packet per read; I don't
> know what they set the stream head limit to.

Well, the stuff I'm working on will eventually work on Solaris, AIX,
Linux, HP/UX, Irix and (possibly) UnixWare so I can get back to you with
some idea of the throughput capability of those platforms as I test them
if you like?

Cheers,
Shaun

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe