Re: Libpcap performance problem

[Rick Jones <rick.jones2 () hp com>]

On 01/28/2015 06:57 AM, Giray Simsek wrote:
> Hi,
> We are currently working on testing Linux network performance. We
> have two Linux machines in our test setup. Machine1 is the attacker
> machine from which we are sending SYN packets to Machine2 at a rate
> of 3million pps. We are able to receive these packets on Machine2's
> external interface and forward them through the internal interface
> without dropping any packets. So far no problems. However, when we
> start another app that captures traffic on Machine2's external
> interface using libpcap, the amount of traffic that is forwarded
> drops significantly. Obviously, this second libpcap app becomes a
> bottleneck. It can capture only about 800Kpps of traffic and only
> about 800Kpps can be forwarded in this case. This drop in the amount
> of forwarded traffic is not acceptable for us.
> Is there any way we can overcome this problem? Are there any settings
> on Os, ixgbe driver or libpcap that will allow us to forward all the
> traffic?
> Both machines are running Linux kernel 3.15.

TCP SYN segments would be something like 66 bytes per (I'm assuming some 
options being set in the SYN).  At 3 million packets per second, that 
would be 198 million bytes per second.  Perhaps overly paranoid of me 
but can the storage on Machine2 keep-up with that without say the bulk 
of the RAM being taken-over by buffer cache and perhaps inhibiting skb 
alloctions?

If you aren't trying to forward the SYNs and just let them bit-bucket, 
is the packet capture able to keep-up?

rick jones

_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers