Re: Libpcap performance under VMWare guest OSes

[Guy Harris <guy () alum mit edu>]

On Dec 10, 2009, at 4:45 PM, Mark Bednarczyk wrote:

> Somehow libpcap, when it taps into this captured traffic, is not able to
> handle a fraction of the actual traffic.

The code path through libpcap shouldn't change merely because you're running in a VM - it should be the exact same, as 
long as the Ubuntu host and guest are using the same version of libpcap.

You say "libpcap 0.8" - does that mean that version of libpcap whose tcpdump.org version number is 0.8.x, or does it 
mean the package that the Debian people (and thus, I think, the Ubuntu people) call "libpcap0.8" regardless of the 
tcpdump.org version number?  In the stable version, it's actually libpcap 0.9.5:

        http://packages.debian.org/search?keywords=libpcap&searchon=names&suite=stable&section=all

I.e., what does "tcpdump -h" print?  That'll give you the tcpdump.org version numbers of libpcap and tcpdump.  Does it 
print the same numbers on the Ubuntu host and guest OSes?

However, even if they're running the same version of libpcap, the code path up *to* libpcap could change.  Are they 
using the same drivers for eth2 on the host and guest machines?  And are they running the same version of the kernel?

(I'm assuming the machine running Windows XP as the host with Ubuntu as a guest has equal or greater capabilities - 
CPU, memory, etc. - than those of the machine running Ubuntu as the host, and that the set of processes running on the 
Ubuntu guest are about the same as those running on the Ubuntu host, so that it's not that the Ubuntu guest is working 
harder at other things, and that there's nothing else significant running on the Windows XP host at the time you're 
doing this, so that it's not that the host isn't giving most of the CPU/memory/etc. to the guest.  It also sounds as if 
your test application is not doing anything with the packets other than counting them, so it's not as if it's dropping 
packets because it can't process them quickly enough or write them quickly enough to a file.)-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.