tcpdump mailing list archives
Re: libpcap & poll()
From: "Gianluca Varenni" <gianluca.varenni () cacetech com>
Date: Fri, 14 Nov 2008 08:08:44 -0800
----- Original Message ----- From: "Ben Greear" <greearb () candelatech com>
To: <tcpdump-workers () lists tcpdump org> Sent: Thursday, November 13, 2008 9:38 PM Subject: Re: [tcpdump-workers] libpcap & poll()
Aaron Turner wrote:On Thu, Nov 13, 2008 at 8:15 PM, Ben Greear <greearb () candelatech com> wrote:I pretty much do the same, but I'm overly paranoid and actually store the entire packet in a queue and compare against those to stop retransmits on Solaris. (You typically immediately read what you just wrote, so the queue comparison usually just pops off the top packet). On Windows, you can use winpcap and it has the ability to not receive what it sends.I guess you have some way of knowing you are reading a packet you just wroteso that you don't do this in a loop?Yep. Basically it's a software bridge (two interfaces, copying all packets from one interface to the other) I track the source MAC address so I know which direction a packet should go.On Linux, as mentioned, I just use raw packet sockets.Well, in a bridge you have to bind to two interfaces, so you'll read from one and write to the other. But, you should be able to do this with only two pcap socketsI do know that if you use a PF_PACKET socket, if you write to it you do not read that packet back on the PF socket. I'm not sure about using pcap toread/write on Linux, however.Interesting... Right now I'm using different handles for read & write so I see packets I send. Obviously not ideal, but if I could use the same handle for read & write that would help out a lot.total.If you get anything working on Windows, I'm interested to know your throughput. Ican't get above about 10Mbps full duplex across my winpcap bridge...
Is it because of the latency introduced by the bridging process (so for example the round trip time is higher and the throughput of a bridged TCP connection goes down) or because of the CPU load bouncing to 100%?
GV
Thanks, Ben --Ben Greear <greearb () candelatech com> Candela Technologies Inc http://www.candelatech.com- This is the tcpdump-workers list.Visit https://cod.sandelman.ca/ to unsubscribe.
- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- Re: libpcap & poll(), (continued)
- Re: libpcap & poll() Gianluca Varenni (Nov 14)
- Re: libpcap & poll() Eloy Paris (Nov 14)
- Re: libpcap & poll() Eloy Paris (Nov 13)
- Re: libpcap & poll() Eloy Paris (Nov 13)
- Re: libpcap & poll() Aaron Turner (Nov 13)
- Re: libpcap & poll() Ben Greear (Nov 13)
- Re: libpcap & poll() Aaron Turner (Nov 13)
- Re: libpcap & poll() Ben Greear (Nov 13)
- Re: libpcap & poll() Aaron Turner (Nov 13)
- Re: libpcap & poll() Aaron Turner (Nov 13)
- Re: libpcap & poll() Gianluca Varenni (Nov 14)
- Re: libpcap & poll() Ben Greear (Nov 14)
- Re: libpcap & poll() Aaron Turner (Nov 13)