Re: Linux ---> FreeBSD

[Guy Harris <guy () alum mit edu>]

On Mon, Sep 01, 2003 at 11:06:59AM +0100, Justin Robinson wrote:
> Ok, I've worked out what it was.... FreeBSD doesn't like having the read
> timeout set to 0.

The behavior of the read timeout on the BSDs is documented in the BPF
man page:

     BIOCSRTIMEOUT

     BIOCGRTIMEOUT  (struct timeval) Set or get the read timeout parameter.
                    The argument specifies the length of time to wait before
                    timing out on a read request.  This parameter is initial-
                    ized to zero by open(2),  indicating no timeout.

so a timeout of 0 means "never time out".

> So I set it to 10 milliseconds. Can anyone tell me an
> optimum value for this, performance-wise?

Purely from a throughput standpoint, the bigger, the better, so that
libpcap gets as many packets as possible per read from the BPF device.

Too large a timeout increases the latency for processing packets that
are arriving infrequently - if, for example, you get one packet, and
then don't get another one for a long period of time, you won't see that
packet until the timeout expires.  (Well, actually, the timeout, in BPF,
starts when the read is done, not when the first packet arrives; it
starts when the first packet arrives in SunOS 4.x and 5.x, and possibly
3.x as well in case anybody still cares about it.)  Therefore, you want
to choose a timeout that's large enough that you get multiple packets
per read whenever possible, and small enough that you don't wait a long
time before seeing packets.

I don't know what the optimum value is, or even if there's *an* optimum
value.  Tcpdump uses 1 second.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe