Simon, On Monday 17 March 2003 17:30, Simon Kirby wrote: > Another list member pointed me to a site of a maintainer for libpcap > containing the modifications Alexey made for PACKET_MMAP support, found > here: > > http://public.lanl.gov/cpw/ That mmapped IO optimised libpcap seems to help in my initial testing, but I need to thoroughly test things out before saying it works fine. > I use this libpcap on a traffic accounting server (Dual P3 550, two > Tigon3 NICs bound to individual CPUs). This made everything much more > reliable due to the reduced overhead and large ring buffer size. It is > even possible to change the ring buffer size to ridiculously-large sizes > to reduce loss from spurts of packets, but there may be some merit in > keeping it smaller for cache coherency reasons (I haven't done any > testing). > > Note that CPU load won't appear to go down by much because the process > still has to sleep and wake up between processing packets, but it will > end up batching a lot more efficiently when there is higher load. When > incoming packets saturate the CPU in interrupt time, the ring buffer > offers some padding so that userspace can catch up later. The only > system call required during normal monitoring is a poll() to let the > process sleep -- the rest is done through the mmap()ped buffer. If the > CPU were completely saturated, no system calls would ever occur from the > monitoring process. > > It would be really nice if this could be accepted into normal libpcap. > It's a fairly straightforward interface and shouldn't be hard to port to > other operating systems, assuming there are no size/endian issues or > other issues I have missed (the main thing I can see right now is the > inclusion of a lot of Linux-specific headers). Thanks for your help Simon. -- Hari harisri@bigpond.com - : send the line "unsubscribe linux-net" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
