Re: [PATCH] tcpdump -s 0 improvement

[Guy Harris <guy () alum mit edu>]

On Nov 30, 2011, at 9:55 AM, David Laight wrote:

> That doesn't preclude the use of variable sized buffers.
> There are several schemes that could have been used that
> have much the same logic, but allow variable sized buffers.

At least with the Linux design, there's a fixed ring buffer of descriptors for packets; the descriptors could refer to 
fixed-size or variable-size slots in a buffer, but even with variable-size slots, there's a fixed array of descriptors, 
allocated at ring-creation time, with each descriptor belonging either to the kernel or userland, with descriptors not 
moving, being created, or being destroyed.  Presumably with variable-size slots there would be more descriptors than 
would be needed for maximum-sized packets, and each descriptor would have a pointer to the packet data, with the 
pointer being set when the buffer space is allocated.

It also appears that the TPACKET_V3 code that appeared somewhere in Linux 3.x may also avoid fixed-size buffers; I'm 
sending its creator, Chetan Loke, some mail asking about it.  Supporting TPACKET_V3 won't help with older kernels that 
don't have it (unless you dig up Chetan's patches, apply them, and build your own kernel), but it will probably help 
with newer kernels.  It might have a ring of blocks of packets, with the descriptors referring to blocks rather than 
packets (which might mean it works a bit more similarly to BPF).-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.