tcpdump mailing list archives

best strategy for receiving millions-packets-per-second


From: "Montorsi, Francesco via tcpdump-workers" <tcpdump-workers () lists tcpdump org>
Date: Mon, 4 May 2020 06:06:26 -0400 (EDT)

--- Begin Message --- From: "Montorsi, Francesco" <fmontorsi () empirix com>
Date: Mon, 4 May 2020 10:08:16 +0000

Hi all,

I hope this is the right mailing list for this kind of questions (also I couldn't find an "archive search" option so 
please forgive me if these questions have already been answered)...


I'm evaluating libpcap as an alternative to the DPDK framework (https://www.dpdk.org/); my use case is RX-only (no TX) 
in promiscuous mode, of wire traffic at speeds in the range [0-20] MPPS on 100Gbps NICs (note that the max theoretical 
PPS is 148 MPPS @64B frames on a 100Gbps link).


I wonder if you can give me pointers on :


a) what's the best way to load-balance received packets across a pool of threads / CPU cores: libpcap API is 
single-thread right?

    Should I create a thread that calls pcap_next_ex(), computes some sort of RSS value on the packet and dispatches it 
to another thread of my app? Is this the best scheme?

   The problem with this approach is that the thread computing the RSS will typically be the bottleneck (since it 
cannot scale)


b) is using pcap_dispatch() a better approach compared to using pcap_next_ex() or it's just the same thing?



Thanks!


Francesco Montorsi
Principal Engineer - Diagnostix Technical Leader (EvA and ECC)
P: +39 059 7409350

www.empirix.com
twitter.com/empirix
linkedin.com/company/empirix


--- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers

Current thread: