Endace DAG w/ tcpdump and libpcap

[rh <rh.forums () verizon net>]

Platform, Configuration, and Input Rates:

8 core Xeon
16 GB RAM
CentOS 5.2
DAG 4.5G2

DAG ring buffer size: 256MB (x2, for 512MB, receive only [i.e., transmit = 0
MB])

tcpdump version is 4.0.0, libpcap 1.0.0

Incoming frame rates (output cleaned up a little -- these increment ~1x
second, and here are 3 consecutive samples completely representative of the
set of dagconfig -ei output records)

[root@mymachine ~]# dagconfig -ei
Port  RxFrames RxBytes
   A       0             0
   B       451          53719
   A       0             0
   B       567          44772
   A       0             0
   B       453          56937

...and so on

Observation:

I'm seeing some indications that tcpdump is dropping a surprisingly high
number of packets even when using a DAG card and what seems to be an
oversized DAG ring buffer allocation for the input rates.

[root@mymachine ~]# tcpdump -i dag0 -s 0 -nnn -w /dev/null -c 100000
tcpdump: listening on dag0, link-type EN10MB (Ethernet), capture size 65535
bytes
100000 packets captured
100000 packets received by filter
33035 packets dropped by kernel

pmap -x of running tcpdump (output cleaned up to show dag0 ring buffer
allocations)
00002b49fb908000  262144       -       -       - rw-s-  dag0
00002b4a0b908000  262144       -       -       - rw-s-  dag0

I doubt very highly that this is a DAG issue, but am wondering if anyone
knows of any inherent bottlenecks between the DAG and libpcap and or tcpdump
?  Wouldn't this affect applications written to access the DAG card via the
libpcap wrapper ?

rh
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.