Re: NIC / driver performance with libpcap

[Andy Howell <AndyHowell () raitechnology com>]

Stephen Donnelly wrote:
> On Wed, 2008-01-09 at 17:12 +0100, Fabian Schneider wrote:
> > Hi Andy,
>
> > > The two metrics I looking at now are:
> > >
> > > - What throughput can I get before seeing dropped packets
> > > - CPU usage
> >       
> > maybe you want to take a look at [1] where I have done exactly this for a
> > special systems with Intel cards. If you want to read more background on  
> > this have a look at [2] where the measurement setup is explained in more  
> > detail.
> >       
> > We are trying to gather all things that enable high performance capturing
> > on the following web page:
> >
> > http://www.net.t-labs.tu-berlin.de/research/hppc/
> >
> > Everybody is welcome to supply further and newer hint and tips on this 
> > topic. 
> >
> > [1] http://www.net.t-labs.tu-berlin.de/papers/SWF-PCCH10GEE-07.pdf
> > [2] http://www.net.t-labs.tu-berlin.de/papers/S-PEPCSHN-05.pdf
>
> Hi Fabian,
>
> I was interested to see that your paper reported strikingly similar
> results to my own investigations.
>
> It seems that modern NIC cards on modern OSs can capture at 1Gbps,
> provided the packet sizes are large (>1000B). As packet sizes decrease
> the CPU load increases until the system drops packets. The limit
> obviously varies with OS and system specifications, but seems to be in
> the few hundred thousand packets per second range, leading to
> significant packet drops for 'typical' packet size distributions even at
> only 1Gbps.
>
> If you'll excuse the commercial slant, you may be interested in my
> whitepaper. Disclaimer: I work for Endace, a company that makes hardware
> specialised for network packet capture.
>
> http://www.endace.com/assets/docs/accelerated/DAGPacketCapturePerformance.pdf

Fabian and Stephen,

	Thanks. Those were quite interesting reads. I liked the idea of having 
a process to soak up available CPU to get a better idea of true CPU 
load, including servicing the NIC.

Andy


-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.