Re: Re: pcap Performance Testimonies

[Richard Sharpe <rsharpe () richardsharpe com>]

On Sun, 21 Sep 2003, Justin Robinson wrote:

>   I'm currently concluding my dissertation that describes a system that 
>   relies entirely on the pcap library for collecting its information.
>   I was unable to run the system in a true test environment.
>
>   Instead I was wondering if a few of you could write some testimonies 
>   in favour of pcap's (and tcpdump's) performance on capturing
>   packets on high speed ethernet connections. Some figures would be 
>   great if you have any. I would also like permission to quote these 
>   testimonies and reference their authors in my dissertation.

We use tcpdump to capture packets at GigE speeds when testing our NAS. We 
capture at wire speed with minimal packet drops when the link is working 
at high speed, but we have to use things like:

  rtprio 10 tcpdump -i bc0 ...

This ensures that capturing runs at high enough priority that packets are 
not dropped. We run with FreeBSD.

We also often have to drop the number of bytes captured per frame back to 
say 96 or 128 bytes.

Regards
-----
Richard Sharpe, rsharpe[at]ns.aus.com, rsharpe[at]samba.org, 
sharpe[at]ethereal.com, http://www.richardsharpe.com

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe