tcpdump mailing list archives
Re: advice for heavy traffic capturing
From: Darren Reed <darrenr () reed wattle id au>
Date: Sun, 15 Aug 2004 05:22:56 +1000 (EST)
Hi Fulvio,
What have you found that makes you say this ? The simplicity in cpu cycle cost ?1. simplicity 2. swappable buffers are very helpful if you plan to make statistics, not only packet capture. For instance, let's think about a system (like a NetFlow probe or something like that) that collects statistics, then it returns data to the user every N minutes. If you have two buffers you can put statistics in the first one, while you can read data from the second one, and swap buffers every N minutes. If you have a ring buffer and your application wants to read data, you have to stop collecting stats, lock the ring, copy its content in another buffer, unlock the ring, read data from the second buffer, and restart computing statistics.
Is it really that hard with a ring ? At least on Unix I think the way to go would be to just make sure that the input side of the ring processing (transferring packets from NICs) was not able to overtake the reading by the user process. Then, with successive calls to uiomove(), data is copied from the ring out to the user process. That is if the number of buffers in the ring is static. Or did you try doing this with Windows and found other problems? Like the copy to user space is so expensive that it is quicker to copy into a new kernel buffer, unlock the ring, and then copy to userspace? btw, do you have any comments on how stable WinPCap2p3 is/was? We had some systems running this but found Windows 2000 to be extremely unreliable (systems would lockup and require a hard reset at least once every 2 weeks.) Darren - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
Current thread:
- Re: advice for heavy traffic capturing, (continued)
- Re: advice for heavy traffic capturing Guy Harris (Aug 08)
- Re: advice for heavy traffic capturing Fulvio Risso (Aug 09)
- Re: advice for heavy traffic capturing Darren Reed (Aug 09)
- Re: advice for heavy traffic capturing Fulvio Risso (Aug 09)
- Re: advice for heavy traffic capturing Darren Reed (Aug 09)
- Re: advice for heavy traffic capturing Fulvio Risso (Aug 09)
- Re: advice for heavy traffic capturing Loris Degioanni (Aug 09)
- Re: advice for heavy traffic capturing Darren Reed (Aug 10)
- Re: advice for heavy traffic capturing Loris Degioanni (Aug 10)
- Re: advice for heavy traffic capturing Motonori Shindo (Aug 12)
- Re: advice for heavy traffic capturing Darren Reed (Aug 14)
- Re: advice for heavy traffic capturing Fulvio Risso (Aug 15)
- Re: advice for heavy traffic capturing Darren Reed (Aug 16)
- Re: advice for heavy traffic capturing Fulvio Risso (Aug 16)
- Re: advice for heavy traffic capturing Guy Harris (Aug 08)