Re: NIC / driver performance with libpcap

[Stephen Donnelly <stephen () endace com>]

On Wed, 2008-01-09 at 17:12 +0100, Fabian Schneider wrote:
> Hi Andy,

> > The two metrics I looking at now are:
> >
> > - What throughput can I get before seeing dropped packets
> > - CPU usage
>       
> maybe you want to take a look at [1] where I have done exactly this for a
> special systems with Intel cards. If you want to read more background on  
> this have a look at [2] where the measurement setup is explained in more  
> detail.
>       
> We are trying to gather all things that enable high performance capturing
> on the following web page:
>
> http://www.net.t-labs.tu-berlin.de/research/hppc/
>
> Everybody is welcome to supply further and newer hint and tips on this 
> topic. 
>
> [1] http://www.net.t-labs.tu-berlin.de/papers/SWF-PCCH10GEE-07.pdf
> [2] http://www.net.t-labs.tu-berlin.de/papers/S-PEPCSHN-05.pdf

Hi Fabian,

I was interested to see that your paper reported strikingly similar
results to my own investigations.

It seems that modern NIC cards on modern OSs can capture at 1Gbps,
provided the packet sizes are large (>1000B). As packet sizes decrease
the CPU load increases until the system drops packets. The limit
obviously varies with OS and system specifications, but seems to be in
the few hundred thousand packets per second range, leading to
significant packet drops for 'typical' packet size distributions even at
only 1Gbps.

If you'll excuse the commercial slant, you may be interested in my
whitepaper. Disclaimer: I work for Endace, a company that makes hardware
specialised for network packet capture.

http://www.endace.com/assets/docs/accelerated/DAGPacketCapturePerformance.pdf

Regards,
Stephen.
-- 
-----------------------------------------------------------------------
    Stephen Donnelly BCMS PhD           email: sfd () endace com
    Endace Technology Ltd               phone: +64 7 839 0540
    Hamilton, New Zealand               cell:  +64 21 1104378
-----------------------------------------------------------------------

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.