Re: libpcap capture performance drop

[Ben Greear <greearb () candelatech com>]

On 05/27/2011 11:03 AM, Guy Harris wrote:
> On May 27, 2011, at 5:20 AM, rixed () happyleptic org wrote:
>
> > If I understand this code correctly, in the next release of the libpcap
> > if a client program ask for a capture length bigger than the MTU then
> > the size allocated for each frame in the ring buffer will be sized down
> > to avoid wasting space ?
>
> If, for a device that's supplying frames with Ethernet headers, and that's not doing any form of offloading that might lead to 
> oversized "packets" being delivered, a program asks for a capture length bigger than the current MTU + 18, the size allocated for 
> each frame in the ring buffer will be sized down.
>
> That's not currently being done for any other link-layer type, as the "+ 18" part is necessary - the frame size needs to be large 
> enough to include not just the payload but the link-layer header (and, in case it happens to get delivered, the CRC), and the MTU for an 
> interface is the size of the largest chunk of data that can be handed to the Ethernet layer to have the header and CRC added, i.e. it's 
> 1500 for non-jumbo-frame Ethernet, and that's not big enough for a maximum-sized Ethernet packet.

Might want to add an extra 4 bytes for a possible VLAN header too.

Thanks,
Ben

--
Ben Greear <greearb () candelatech com>
Candela Technologies Inc  http://www.candelatech.com

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.