Re: Libpcap performance problem

[David Laight <David.Laight () ACULAB COM>]

From: Rick Jones
> On 01/28/2015 06:57 AM, Giray Simsek wrote:
> > Hi,
> > We are currently working on testing Linux network performance. We
> > have two Linux machines in our test setup. Machine1 is the attacker
> > machine from which we are sending SYN packets to Machine2 at a rate
> > of 3million pps. We are able to receive these packets on Machine2's
> > external interface and forward them through the internal interface
> > without dropping any packets. So far no problems. However, when we
> > start another app that captures traffic on Machine2's external
> > interface using libpcap, the amount of traffic that is forwarded
> > drops significantly. Obviously, this second libpcap app becomes a
> > bottleneck. It can capture only about 800Kpps of traffic and only
> > about 800Kpps can be forwarded in this case. This drop in the amount
> > of forwarded traffic is not acceptable for us.
> > Is there any way we can overcome this problem? Are there any settings
> > on Os, ixgbe driver or libpcap that will allow us to forward all the
> > traffic?
> > Both machines are running Linux kernel 3.15.
>
> TCP SYN segments would be something like 66 bytes per (I'm assuming some
> options being set in the SYN).  At 3 million packets per second, that
> would be 198 million bytes per second.  Perhaps overly paranoid of me
> but can the storage on Machine2 keep-up with that without say the bulk
> of the RAM being taken-over by buffer cache and perhaps inhibiting skb
> alloctions?

More likely is that running pcap requires that every receive packet
be copied (so it can be delivered to pcap and IP).
The cost of doing this could easily be significant.

Even setting a pcap filter to return no packets will invoke the
same overhead.
As does running the dhcp client!

        David

_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers