Re: libpcap capture performance drop

[Guy Harris <guy () alum mit edu>]

On May 23, 2011, at 9:58 AM, Rick Jones wrote:

> Are there alignment differences for the different buffer sizes?  For
> example, when one would use 1518, would one be better-off using 1520 to
> end on a 4 byte boundary and so begin on a 4 byte boundary if these
> buffers are carved one after the other?

To quote the Linux packet_mmap.txt file:

> If you check the source code you will see that what I draw here as a frame
> is not only the link level frame. At the beginning of each frame there is a 
> header called struct tpacket_hdr used in PACKET_MMAP to hold link level's frame
> meta information like timestamp. So what we draw here a frame it's really 
> the following (from include/linux/if_packet.h):
>
> /*
>    Frame structure:
>
>    - Start. Frame must be aligned to TPACKET_ALIGNMENT=16
>    - struct tpacket_hdr
>    - pad to TPACKET_ALIGNMENT=16
>    - struct sockaddr_ll
>    - Gap, chosen so that packet data (Start+tp_net) aligns to 
>      TPACKET_ALIGNMENT=16
>    - Start+tp_mac: [ Optional MAC header ]
>    - Start+tp_net: Packet data, aligned to TPACKET_ALIGNMENT=16.
>    - Pad to align to TPACKET_ALIGNMENT=16
>  */

so the link-layer payload is always aligned on a 16-byte boundary.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.