tcpdump mailing list archives
Re: Libpcap performance problem
From: David Laight <David.Laight () ACULAB COM>
Date: Wed, 28 Jan 2015 17:17:15 +0000
From: Rick Jones
On 01/28/2015 06:57 AM, Giray Simsek wrote:Hi, We are currently working on testing Linux network performance. We have two Linux machines in our test setup. Machine1 is the attacker machine from which we are sending SYN packets to Machine2 at a rate of 3million pps. We are able to receive these packets on Machine2's external interface and forward them through the internal interface without dropping any packets. So far no problems. However, when we start another app that captures traffic on Machine2's external interface using libpcap, the amount of traffic that is forwarded drops significantly. Obviously, this second libpcap app becomes a bottleneck. It can capture only about 800Kpps of traffic and only about 800Kpps can be forwarded in this case. This drop in the amount of forwarded traffic is not acceptable for us. Is there any way we can overcome this problem? Are there any settings on Os, ixgbe driver or libpcap that will allow us to forward all the traffic? Both machines are running Linux kernel 3.15.TCP SYN segments would be something like 66 bytes per (I'm assuming some options being set in the SYN). At 3 million packets per second, that would be 198 million bytes per second. Perhaps overly paranoid of me but can the storage on Machine2 keep-up with that without say the bulk of the RAM being taken-over by buffer cache and perhaps inhibiting skb alloctions?
More likely is that running pcap requires that every receive packet be copied (so it can be delivered to pcap and IP). The cost of doing this could easily be significant. Even setting a pcap filter to return no packets will invoke the same overhead. As does running the dhcp client! David _______________________________________________ tcpdump-workers mailing list tcpdump-workers () lists tcpdump org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
Current thread:
- Libpcap performance problem Giray Simsek (Jan 28)
- Re: Libpcap performance problem Anders Broman (Jan 28)
- Re: Libpcap performance problem Giray Simsek (Jan 29)
- Re: Libpcap performance problem Rick Jones (Jan 28)
- Re: Libpcap performance problem David Laight (Jan 28)
- Re: Libpcap performance problem Giray Simsek (Jan 29)
- Re: Libpcap performance problem David Laight (Jan 28)
- Re: Libpcap performance problem Anders Broman (Jan 28)