Re: pcap_next_ex() and pcap_dump() performance decreases over time...

[Guy Harris <guy () alum mit edu>]

On Aug 22, 2015, at 12:48 PM, barcaroller <barcaroller () gmail com> wrote:

> I've been running performance tests against pcap_next_ex() and pcap_dump().  I've placed micro-second timers around 
> both functions

So those are presumably real-time timers rather than CPU timers.

> and sent millions of packets to my test programs.
>
> Both functions performed admirably over a short period of time (up to 8 Gbits/sec) but, as time progressed, both 
> functions became increasingly slower until the data rate dropped to 200 Mbits/sec.

How short is "short"?  Tens of seconds?  Minutes?

> Please note that the two functions become slower even when I read/wrote new pcap files (i.e. I would close a pcap 
> file and start reading/writing a new PCAP file, but the performance still remained low).

What happens if you have a test program that doesn't write the packets out?

> Does anyone know how to explain this?

Not without at least knowing on what OS you're doing this.  Those routines make system calls, so there might be a 
*kernel* resource involved.

_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers