Re: AIX BPF Buffer Size

[Guy Harris <guy () netapp com>]

On Tue, Feb 11, 2003 at 02:31:56PM +1100, Shaun wrote:
> I notice that on AIX during the BPF buffer size selection loop (BIOCSBLEN)
> the buffer size ends up being around 16k. For those of us who aren't
> particularly familiar with the buffers used on other platforms is this
> small a value normal?

Currently, the code starts at 32K; on some platforms, such as NetBSD,
that's the maximum buffer size available.

The BPF code starts at 32K and keeps trying smaller sizes, dividing by
half, until it's allowed to do a BIOCSBLEN and a BIOCSETIF to set the
size to the specified value.

If it ends up being around 16K, that means that 32K doesn't work and 16K
does; perhaps that's all the buffering AIX lets you have.

> By my calculations this space will be filled about
> 78 times a second on a busy 10MB Ethernet. How can I hope to keep up with
> the traffic on the network at this sort of rate?

By reading from the buffer 78 or more times a second.  That requires
that you take less than ~.0128 seconds to handle 16K worth of packets,
including waking up, reading the packets, and processing them.  All that
a bigger buffer does is reduce the amount of time spent doing wakeups
and per-system-call overhead for reads, by letting you do fewer reads. 
If that's not the bottleneck, a bigger buffer ultimately won't help
unless you capture for a time short enough to fill only the kernel's
buffer; the expectation is that an application might well keep
capturing, not that the kernel's buffer will always be large enough for
all captures.

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe