Re: libpcap capture performance drop

[Rick Jones <rick.jones2 () hp com>]

On Fri, 2011-05-20 at 12:02 -0700, Guy Harris wrote:
> On Sep 6, 2010, at 11:45 AM, Doktor Bernd wrote:
>
> > If I recompile with the HAVE_PACKET_RING stuff *not* commented out I get the bad performance as with the packaged 
> > versions from Ubuntu. So the performance drop is caused by that part of libpcap.
>
> The packet-ring stuff has fixed-length slots, which means that the number of slots is the buffer size divided by the 
> size of the slots.
>
> The slot size is calculated from the snapshot length; what snapshot length are you using?  If, for example, this is 
> on Ethernet, and your snapshot length is > 1518 (1518 just in case the CRC is delivered as part of the packet; it is 
> with BPF in Mac OS X, for example, and I think on some other BPF platforms, but it might not be on Linux), that might 
> reduce the number of ring buffer slots and thus increase the number of packet drops, especially if the snapshot 
> length is, for example, the tcpdump/Wireshark default of 65535.-

Are there alignment differences for the different buffer sizes?  For
example, when one would use 1518, would one be better-off using 1520 to
end on a 4 byte boundary and so begin on a 4 byte boundary if these
buffers are carved one after the other?

rick jones

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.