Re: dumpcap performance?

[Guy Harris <guy () alum mit edu>]

On Feb 22, 2013, at 1:39 PM, Jeff Morriss <jeff.morriss.ws () gmail com> wrote:

> Basically you're proposing building one bigger buffer for writing rather than doing several smaller writes?
>
> My experience would say no: memcpy()s should be avoided whenever possible.  Admittedly my experience does not include 
> a lot of file I/O but I would think/hope the OS would do a good job of buffering smaller writes into larger I/Os.

If standard I/O (FILE *'s) is being used, doing extra copies into a buffer and a single fwrite() will probably hurt 
rather than helping, as standard I/O does the buffering in userland, so the copies into a buffer (which is probably 
somewhere between 4K and 8K in size, but may be larger) are already being done by fwrite().  We're using standard I/O 
in that code path.

If write() were being used directly, doing extra copies into the buffer and a single write() *might* help, as, while 
there is buffering being done in the kernel, you would be making more system calls with multiple write()s.  (That's one 
reason for the standard I/O library - it does that buffering for you.)

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe