tcpdump mailing list archives
Re: setting the initial ring size
From: Andy Howell <AndyHowell () raitechnology com>
Date: Mon, 07 Jan 2008 18:05:11 -0600
Abeni Paolo wrote:
hello, In the current cvs, at least the bpf, the win32 and the linux (memory mapped) platforms use an internal buffer to perform the capture. The buffer size is currently user-configurable only for the win32 platform, and it would be nice to be able to do the same also on other platform, but the bpf don't allow to change the buffer size after the capture is started.
Paolo,It is possible to set the size on linux, though not through the API. I get the socket with pcap_fileno( descr ). My code does something like:
unsigned int bufSize; socklen_t sockLen; socket = pcap_fileno( desc ) sockLen = sizeof( bufSize ); bufSize= some-whacking-big-number ~ 32Mb setsockopt( socket, SOL_SOCKET, SO_RCVBUF, &bufSize, &sockLen );There could certainly be a more portable way to do this. With the buffer size set to 32Mb, I don't get any drops at gigabit speeds. That depends on the NIC / driver version.
The above does not work with Solaris however. It has to set the buffer size when the device is opened. I've hacked libpcap to do that, but the performance is not that great. With the increased buffer size, I tend to see a larger number of dropped packets, though the drops are less frequent. This is on Solaris 8 & 9. Solaris 10 is supposed to be better, but I haven't had a chance to try that yet.
A possible solution is to add a static variable to handle the buffer size and add a libpcap call to modify/set it's value which should be used as default by the various open method. The new function does not get a pcap handle as parameter, since it operates on a global variable; moreover calling it does not influence already opened captures. Since both bpf and linux shrink the said buffer if the creation fails due to insufficient memory available, it would be useful to add another pcap function to retrieve the capture buffer size for a given capture. If this idea sounds reasonable, I can post a patch to implement it.
Having a portable way to set the buffer size would be nice. I don't know that it could be done across all platforms though. Having a generic interface of libpcap is useful, but it would also be nice to offer platform specific features as well.
A 'capabilities' API could be useful. It would allow the developer to take advantage of platform specific features in a generic way. Capabilities might include:
Can get/set receive buffer size Has nmap Has pf_ring Set filter flushes packets Has extended statistics Can set direction Regards, Andy - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- setting the initial ring size Abeni Paolo (Jan 07)
- Re: setting the initial ring size Andy Howell (Jan 07)
- Re: setting the initial ring size Guy Harris (Jan 09)
- Re: setting the initial ring size Abeni Paolo (Jan 10)
- Re: setting the initial ring size Guy Harris (Jan 10)
- Re: supporting extend 'open live capture' parametes [was: setting the initial ring size] Abeni Paolo (Jan 10)
- Re: supporting extend 'open live capture' parametes Guy Harris (Jan 10)
- Re: supporting extend 'open live capture' parametes Andy Howell (Jan 10)
- Re: supporting extend 'open live capture' parametes Guy Harris (Jan 10)
- Re: supporting extend 'open live capture' parametes Andy Howell (Jan 11)
- Re: supporting extend 'open live capture' parametes Michael Richardson (Jan 13)
- Re: supporting extend 'open live capture' parametes Guy Harris (Jan 13)
- Re: setting the initial ring size Guy Harris (Jan 09)
- Re: setting the initial ring size Andy Howell (Jan 07)