Re: Best OS / Distribution for gigabit capture?

["M. V." <bored_to_death85 () yahoo com>]

> > as i mentioned in my previous mail, (with the title: "HUGE packet-drop") i'm
> > having problem trying to dump gigabit traffic on harddisk with tcpdump on
> > Debian5.0. i tried almost everything but got no success. so, i decided to
> > start-over:
> >
> > *) if anyone has experience on successful gigabit capture, what combination 
of
> > "Operating-System / Distribution / Kernel Version / libpcap version / ..." do
> > you suggest for maximum zero-packet-loss capture?

> What are you going to do with the packets?
> Can you process the packets that you capture with few enough
> CPU cycles that you never cause backlog?

hi,

right now, no (extra) process is being done on packets. tcpdump (or dumpcap) 
simply dumps received packets (whole packet, with s = 0) into file(s). my HP 
server's HDD performance is good, and i also tried dumping on SSD and RAMDisk 
and i increased kernel buffer-sizes,  but my best zero-packet-loss result is 
something about 350Mbps (this result is with libpcap-0.9.8. i got much worse 
results with libpcap-1.0+).



      -
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.