Wireshark mailing list archives
High speed packet captures - libpcap with TPACKET_V3
From: Anders Broman <a.broman () bredband net>
Date: Sun, 10 Nov 2013 11:50:27 +0100
Hi,The upcoming libpcap 1.5 have support for TPACKET_V3 which seems to improve on packet drops at high sped captures. However some tests on a 1 Gb link with ~900 Mb/s indicates that tcpdump does better than dumpcap possibly because dumpcap uses "inpkts = pcap_dispatch(pcap_opts->pcap_h, 1, capture_loop_write_packet_cb, (u_char *)pcap_opts);" fetching packets one by one rather than using -1.
Any way, any one interesting in looking into making dumpcap more efficient? Regards Anders ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- High speed packet captures - libpcap with TPACKET_V3 Anders Broman (Nov 10)
- Re: High speed packet captures - libpcap with TPACKET_V3 Jakub Zawadzki (Nov 10)