Re: tcpdump vs libpcap : CPU usage shooting high for two simultaneous captures on wireless monitor interfaces

[Guy Harris <guy () alum mit edu>]

On Apr 17, 2013, at 3:57 PM, abhinav narain <abhinavnarain10 () gmail com> wrote:

> Can someone explain this behavior ? 

As you're saying "libpcap" rather than WinPcap, I'm assuming this is some flavor of UN*X, such as Linux.

Could you build a profiled version of your tool (compile with "-pg") and then run gprof on the tool and the gmon.out 
file it produces when it exits?  That should show you *where* the CPU time is being spent.

This means that the program has to eventually exit cleanly - you can't interrupt it with, for example, ^C unless it 
catches SIGINT and exits, otherwise it'll fail to write out the gmon.out file.

This might also be tricky if you cross-compile the tool to run on the router, and the router doesn't have gprof 
installed - you might have to have a version of gprof capable of analyzing executable files and gmon.out files from the 
router.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers