Re: packet drops and zero copy filtering?

[Ben Greear <greearb () candelatech com>]

Guy Harris wrote:
> On Sun, Jul 13, 2003 at 03:32:56PM -0700, Yuchung Cheng wrote:
>
> > I also run tcpdump on a busy gigabites link (90MBps) and tcpdump is dropping
> > lots of packets and locking up the cpu, is there any patch for using Linux
> > sendfile(2) to minimize dumping to file overhead for capturing?
>
>
> Well, that might be an interesting patch, but it wouldn't write out a
> tcpdump-format file, it'd write out a Linux-format file (and given that
> at least some of the information in the packet header isn't returned by
> "recvfrom()" in the buffer, it's returned from elsewhere, it might not
> even be possible without a *kernel* patch as well).

Seems you cannot use sendfile when reading from a socket, so can't
capture like this.  It will definately need a kernel module.

Ben


--
Ben Greear <greearb () candelatech com>       <Ben_Greear AT excite.com>
President of Candela Technologies Inc      http://www.candelatech.com
ScryMUD:  http://scry.wanfear.com     http://scry.wanfear.com/~greear


-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe