On Sun, Mar 16, 2003 at 07:23:49PM +1100, Srihari Vijayaraghavan wrote: > We see tcpdump reporting "xyz packets dropped by kernel" on the 100 Tx > card(s). > > We begin to see this message when our packet rates exceed 10,000 > packets/sec/interface. The packet size is currently 70 bytes. > We have proven that the kernel is correctly recording the number of > packets, however TCPdump (of libpcap?) appears to be dropping some. >... > Also we have the "Packet Socket: mmaped IO" support enabled in the > kernel, however is there a way to confirm if tcpdump/libpcap are > utilising that feature (that is if that feature would help our scenario > in the first place). Can it be confirmed by running tcpdump through > strace?, if yes what is the evidence to look forward to? (is it mmap2 > function calls?) Hello, Another list member pointed me to a site of a maintainer for libpcap containing the modifications Alexey made for PACKET_MMAP support, found here: http://public.lanl.gov/cpw/ I use this libpcap on a traffic accounting server (Dual P3 550, two Tigon3 NICs bound to individual CPUs). This made everything much more reliable due to the reduced overhead and large ring buffer size. It is even possible to change the ring buffer size to ridiculously-large sizes to reduce loss from spurts of packets, but there may be some merit in keeping it smaller for cache coherency reasons (I haven't done any testing). Note that CPU load won't appear to go down by much because the process still has to sleep and wake up between processing packets, but it will end up batching a lot more efficiently when there is higher load. When incoming packets saturate the CPU in interrupt time, the ring buffer offers some padding so that userspace can catch up later. The only system call required during normal monitoring is a poll() to let the process sleep -- the rest is done through the mmap()ped buffer. If the CPU were completely saturated, no system calls would ever occur from the monitoring process. It would be really nice if this could be accepted into normal libpcap. It's a fairly straightforward interface and shouldn't be hard to port to other operating systems, assuming there are no size/endian issues or other issues I have missed (the main thing I can see right now is the inclusion of a lot of Linux-specific headers). Simon- [ Simon Kirby ][ Network Operations ] [ sim@netnation.com ][ NetNation Communications ] [ Opinions expressed are not necessarily those of my employer. ] - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
