tcpdump mailing list archives
PCAP performance
From: "Hans Klute" <hklute () gmx de>
Date: Thu, 1 Apr 2004 14:12:35 +0200 (MEST)
Hi! I have written a packet sniffer under C++ using libpcap. Now I have noticed that about every 3 minutes and 15 seconds the Program uses 100 % of the CPU. After about 45 sec the program works normal again and uses only 10% of the CPU time. The program is running on a 300 MHz Celeron with 128 MB RAM under Slackware 8.1. I also tried it under a 1600 Athlon XP with 512 MB RAM under SuSeE 8.2. There was the same behaviour, except that it only used 80% of the CPU and it was back normal faster. I use libpcap 0.8.1 and pcap_dispatch, which is called in a while statement of a pthread, with 1 as parameter for number of packets to capture. I first thought that I made a mistake in the call-back function, but I replaced my code with return and it did the same thing. I tested the program with hping2 and sent a packet every 10 ms. The used filter is quite long and consists of about 150 pairs of IP-Addresses and Ports. Please help Hans Klute -- +++ NEU bei GMX und erstmalig in Deutschland: TÜV-geprüfter Virenschutz +++ 100% Virenerkennung nach Wildlist. Infos: http://www.gmx.net/virenschutz - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
Current thread:
- PCAP performance Hans Klute (Apr 01)
- Re: PCAP performance sthaug (Apr 01)
- Re: PCAP performance Hans Klute (Apr 01)
- Re: PCAP performance Guy Harris (Apr 01)
- Re: PCAP performance Hans Klute (Apr 02)
- Re: PCAP performance sthaug (Apr 04)
- Re: PCAP performance Hans Klute (Apr 02)
- Re: PCAP performance sthaug (Apr 01)