Re: packet drops and zero copy filtering?

[Guy Harris <guy () alum mit edu>]

On Sun, Jul 13, 2003 at 03:32:56PM -0700, Yuchung Cheng wrote:
> I also run tcpdump on a busy gigabites link (90MBps) and tcpdump is dropping
> lots of packets and locking up the cpu, is there any patch for using Linux
> sendfile(2) to minimize dumping to file overhead for capturing?

Well, that might be an interesting patch, but it wouldn't write out a
tcpdump-format file, it'd write out a Linux-format file (and given that
at least some of the information in the packet header isn't returned by
"recvfrom()" in the buffer, it's returned from elsewhere, it might not
even be possible without a *kernel* patch as well).

> Or can someone recommend tools for high speed capturing (for Linux)?

Phil Wood's patch to use the memory-mapped capture mechanism:

        http://public.lanl.gov/cpw/

might help, although it's not zero-copy if you're writing to a file.

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe