Re: single packet capture time w/pcap vs. recvfrom()

[Brandon Stafford <brandon () mindtribe com>]

Guy Harris wrote:
> If a received packet has a bad IP header or UDP checksum, it should get 
> discarded at the IP or UDP layer, so that your application would *never* 
> see it, not just see it after 20ms.

	I should have been more clear-- the UDP packets have 
checksums of 0x00, not bad checksums. I believe that this 
means that the checksum is ignored. This still does not 
explain the 20 ms execution time.

> If that's what you want - i.e., if the server is supposed to log all the 
> UDP packets in question, even if they have a checksum error - then it 
> should use libpcap.

	I have rewritten the application using libpcap, and it is 
definitely faster. The receive time now varies between < 1 
ms to ~12 ms. I haven't tested it very thoroughly yet, so I 
don't know how it does under load. Also, I'm using 
pcap_next() to grab one packet at a time. I could probably 
do better grabbing a few at once.

I'll keep you posted. Thanks for the response and the software.

Brandon


-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.