tcpdump mailing list archives
Re: libpcap capture performance drop
From: Guy Harris <guy () alum mit edu>
Date: Sun, 15 Aug 2010 16:43:37 -0700
On Aug 15, 2010, at 6:15 AM, Doktor Bernd wrote:
thanks for the advice. If I use libpcap 1.1.1 compiled with the HAVE_PACKET_RING stuff commented out, the my softare performs very well. Ubuntu currently ships with 1.0.0.6 I think. If I use that version my application has problems capturing 100 Mbit/s of traffic. If I change to the custom build version of libpcap then I can capture 1 Gbit/s of traffic and problem occur only for small packet sizes (<100 Byte).
What happens if you build 1.1.1 with no changes (i.e., with the HAVE_PACKET_RING stuff *not* commented out) and use that version? That's the cleanest test of mmap vs. non-mmap.
Any idea why mmap is slowing everything down? I am using pcap_dispatch to capture packet by packet.
(That means you're not using pcap_next() or pcap_next_ex(), correct?) What are you passing as the second argument to pcap_dispatch()? And how are you measuring the packet loss? Are you using the figures from pcap_stats(), or are you determining in some other fashion that packets weren't captured?- This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- libpcap capture performance drop Doktor Bernd (Aug 10)
- Re: libpcap capture performance drop Guy Harris (Aug 13)
- Re: libpcap capture performance drop Doktor Bernd (Aug 15)
- Re: libpcap capture performance drop Guy Harris (Aug 15)
- Re: libpcap capture performance drop Doktor Bernd (Sep 06)
- Re: libpcap capture performance drop Doktor Bernd (Aug 15)
- Re: libpcap capture performance drop Miroslav Lichvar (Aug 16)
- Re: libpcap capture performance drop Guy Harris (Aug 13)