pcap_next_ex() and pcap_dump() performance decreases over time...

[barcaroller <barcaroller () gmail com>]

I've been running performance tests against pcap_next_ex() and 
pcap_dump().  I've placed micro-second timers around both functions and 
sent millions of packets to my test programs.

Both functions performed admirably over a short period of time (up to 8 
Gbits/sec) but, as time progressed, both functions became increasingly 
slower until the data rate dropped to 200 Mbits/sec.

Please note that the two functions become slower even when I read/wrote 
new pcap files (i.e. I would close a pcap file and start 
reading/writing a new PCAP file, but the performance still remained 
low).  At no time did the size of these pcap files exceed 100MB.  Only 
when I re-started the test programs did the performance go up again.  
It's as if there is a process-wide global resource, independent of the 
pcap files, that gets used up by pcap_next_ex() and pcap_dump() as the 
process is running.

Does anyone know how to explain this?


_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers