Re: Different/Same queue used for promiscuous capture on ethernet ?

[Guy Harris <guy () alum mit edu>]

On Oct 5, 2013, at 10:20 AM, abhinav narain <abhinavnarain10 () gmail com> wrote:

> Hi Everyone,
> I am doing a packet capture on 480 MHz router on ethernet interface using
> pcap and see packet drops for anything greater than 50-60 Mbps.
>
> My question is following :
> Does pcap (and hence the kernel) create a new queue for all the packets in
> the promiscuous or is it collecting all packets in the same/default queue
> attached to the interface eth0 ?

I infer from "eth0" that this is Linux.  (DD-WRT or some other OpenWRT-based project?)

On Linux, libpcap creates a PF_PACKET socket for each open pcap_t for a regular network interface such as eth0.  Each 
PF_PACKET socket has a queue of its own, regardless of promiscuous mode.

What queueing the *driver* for the adapter does depends on the driver.

> I am asking above question because I want to know if the router starts
> dropping packets destined to itself because of this promiscuous mode
> capture?

        ...

> Router used :
> http://support.netgear.com/product/WNDR3700v2

Do you have more than one machine plugged into the LAN ports of the router?

According to

        http://wiki.openwrt.org/toh/netgear/wndr3700#interfaces

eth0 is for the "LAN ports (1 to 4)" and, according to

        http://wiki.openwrt.org/toh/netgear/wndr3700#switch.ports.for.vlans

eth0 is port 5 on a Realtek RTL8366s:

        http://realtek.info/pdf/rtl8366s_8366sr_datasheet_vpre-1.4_20071022.pdf

switch chip.

If eth0 is not in promiscuous mode, I would assume that only traffic going between machines on the Ethernet LAN and 
machines on the 802.11 WLAN would arrive on eth0, not traffic between two machines on the Ethernet LAN.  I don't know 
whether the eth0 port can be put into a port mirroring mode where traffic on all the Ethernet LAN ports can be sent to 
the eth0 port or, if it can, whether the driver does so if eth0 is put into promiscuous mode, so that it sees all 
traffic through the switch, not just traffic to be sent to the WLAN.

If it *is* put into mirroring mode, and you have a significant amount of traffic going between Ethernet LAN hosts, then 
promiscuous mode would significantly increase the number of packets received.

If it's *not* put into mirroring mode, promiscuous mode shouldn't make any difference.

Are you capturing in promiscuous mode?  If so, do you see as many packets dropped if you *don't* capture in promiscuous 
mode?

By the way, according to

        http://www.dd-wrt.com/wiki/index.php/Netgear_WNDR3700

the v2 model has a Atheros AR7161 680 MHz processor; the only model they list with a 480 MHz processor is the v3 model, 
with a Broadcom BCM4718A 480MHz processor.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers