Yeah that a final alternative. Actually I was looking for some optimized way of getting packet filtered at kernel level using BPF filter.
On 21 December 2011 06:22, Mulyadi Santosa <mulyadi.santosa@xxxxxxxxx> wrote:
Hi Mukesh..
I have zero experience with BPF, so this is just my theory.
On Wed, Dec 21, 2011 at 01:38, Mukesh Yadav <mukesh.fkd@xxxxxxxxx> wrote:
> BPF filters used are:
> Even IP filter :-> tcpdump -i interface 'ether dst <dest mac> && ip[19] &
> 0x01 = 0'
> Odd IP filter :-> tcpdump -i interface 'ether dst <dest mac> && ip[19] &
> 0x01 = 1'
>
> There is a packet loss for odd IP thread even when CPU is available. Reason
> being packet drop due recv buffer full.
> Same amount of traffic is well handled by even IP thread(user code being
> same in both), scaling CPU to full 100%.
>
> In odd IP thread, If filter is changed to "tcpdump -i interface 'ether dst
> <dest mac> && ip proto 17' ", all goes fine.
> Also CPU usage at kernel drops from 50% to 4 % for a particular amount of
> traffic.
In kernel level, (or maybe between kernel and user level), by putting
your odd and even filter, kernel work too hard to separate the packets
into different "queue" or "channel"...or something like that. While in
the mean time, incoming packets are bursting .... This makes buffers
filled up fast.
How about this... just filter anything that match your target
MAC....fed this up to the user level application and let your
application do the odd and even IP filtering?
--
regards,
Mulyadi Santosa
Freelance Linux trainer and consultant
blog: the-hydra.blogspot.com
training: mulyaditraining.blogspot.com
--
Cheers
Mukesh Yadav
Senior Software Engineer
Plot6 Sector 18
Aricent
Gurgaon
Mob: 9953024169
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@xxxxxxxxxxxxxxxxx http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
