Re: libpcap capture performance drop

[Guy Harris <guy () alum mit edu>]

On Sep 6, 2010, at 11:45 AM, Doktor Bernd wrote:

> If I recompile with the HAVE_PACKET_RING stuff *not* commented out I get the bad performance as with the packaged 
> versions from Ubuntu. So the performance drop is caused by that part of libpcap.

The packet-ring stuff has fixed-length slots, which means that the number of slots is the buffer size divided by the 
size of the slots.

The slot size is calculated from the snapshot length; what snapshot length are you using?  If, for example, this is on 
Ethernet, and your snapshot length is > 1518 (1518 just in case the CRC is delivered as part of the packet; it is with 
BPF in Mac OS X, for example, and I think on some other BPF platforms, but it might not be on Linux), that might reduce 
the number of ring buffer slots and thus increase the number of packet drops, especially if the snapshot length is, for 
example, the tcpdump/Wireshark default of 65535.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.