Re: pcap_dispatch on linux 2.6 with libpcap 1.1.1

[Guy Harris <guy () alum mit edu>]

On Aug 22, 2010, at 11:44 PM, Guy Harris wrote:

> On Aug 21, 2010, at 3:30 PM, Jim Lloyd wrote:
>
> > Does this mean the 512Mb memory buffer is huge overkill?
>
> For this application, it might be.

Of course, we must bear in mind that the average human has one breast and one testicle.[*] :-)

*On average*, a buffer big enough to hold 4 packets would be sufficient if you're getting between 3.009 and 3.5 
packets, on average, when capturing, but if, for example, some packets require a lot more processing in your 
application than others, you might, for example, get 10 packets while processing some batches of packets.  Even given 
that, 512MB is probably overkill, but the interesting numbers to measure for that are the maximum number of bytes worth 
of packet data and the number of packets in that batch, and the maximum number of packets in a batch.  From that, you 
can calculate the amount of buffer space required for both of those extreme-case batches.

[*]Approximately.-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.