Re: libpcap capture performance drop

[Doktor Bernd <doktorbernd () hotmail com>]

Hi,

back from vacation I had some time to test libpcap again

> > thanks for the advice. If I use libpcap 1.1.1 compiled with the HAVE_PACKET_RING stuff commented out, the my 
> > softare performs very well.
> > Ubuntu currently ships with 1.0.0.6 I think. If I use that version my application has problems capturing 100 Mbit/s 
> > of traffic. If I change to the custom build version of libpcap then I can capture 1 Gbit/s of traffic and problem 
> > occur only for small packet sizes (<100 Byte).
>
> What happens if you build 1.1.1 with no changes (i.e., with the HAVE_PACKET_RING stuff *not* commented out) and use 
> that version?  That's the cleanest test of mmap vs. non-mmap.

If I recompile with the HAVE_PACKET_RING stuff *not* commented out I get the bad performance as with the packaged 
versions from Ubuntu. So the performance drop is caused by that part of libpcap.

> > Any idea why mmap is slowing everything down? I am using pcap_dispatch to capture packet by packet.
>
> (That means you're not using pcap_next() or pcap_next_ex(), correct?)

correct

> What are you passing as the second argument to pcap_dispatch()?

1

> And how are you measuring the packet loss?  Are you using the figures from pcap_stats(), or are you determining in 
> some other fashion that packets weren't captured?-

I am generating my own packets and compare sent vs. received numbers. For generating the packets another PC is used.

Bernd

                                          -
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.