Re: setting the initial ring size

[Andy Howell <AndyHowell () raitechnology com>]

Abeni Paolo wrote:
> hello,
>
> In the current cvs, at least the bpf, the win32 and the linux (memory
> mapped) platforms use an internal buffer to perform the capture. The
> buffer size is currently user-configurable only for the win32
> platform, and it would be nice to be able to do the same also on
> other platform, but the bpf don't allow to change the buffer size
> after the capture is started.

Paolo,

It is possible to set the size on linux, though not through the API. I 
get the socket with pcap_fileno( descr ). My code does something like:

unsigned int bufSize;
socklen_t    sockLen;

socket = pcap_fileno( desc )
sockLen = sizeof( bufSize );
bufSize= some-whacking-big-number ~ 32Mb
setsockopt( socket, SOL_SOCKET, SO_RCVBUF, &bufSize, &sockLen );

There could certainly be a more portable way to do this. With the buffer 
size set to 32Mb, I don't get any drops at gigabit speeds. That depends 
on the NIC / driver version.

The above does not work with Solaris however. It has to set the buffer 
size when the device is opened. I've hacked libpcap to do that, but the 
performance is not that great. With the increased buffer size, I tend to 
see a larger number of dropped packets, though the drops are less 
frequent. This is on Solaris 8 & 9. Solaris 10 is supposed to be better, 
but I haven't had a chance to try that yet.

> A possible solution is to add a static variable to handle the buffer
> size and add a libpcap call to modify/set it's value which should be
> used as default by the various open method. The new function does not
> get a pcap handle as parameter, since it operates on a global
> variable; moreover calling it does not influence already opened
> captures. Since both bpf and linux shrink the said buffer if the
> creation fails due to insufficient memory available, it would be
> useful to add another pcap function to retrieve the capture buffer
> size for a given capture.
>
> If this idea sounds reasonable, I can post a patch to implement it.

Having a portable way to set the buffer size would be nice. I don't know 
that it could be done across all platforms though. Having a generic 
interface of libpcap is useful, but it would also be nice to offer 
platform specific features as well.

A 'capabilities' API could be useful. It would allow the developer to 
take advantage of platform specific features in a generic way. 
Capabilities might include:

        Can get/set receive buffer size
        Has nmap
        Has pf_ring
        Set filter flushes packets
        Has extended statistics
        Can set direction

Regards,

        Andy

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.