Execution time for pcap_next_ex

["Tescik Ramos Aladro" <tescik.aladro () fmtppower com>]

Hi!

 

I’m trying to get an idea of the performance of the pcap_nect_ex function in
a linux environment (ubuntu 14.04)

I just have a loop where I call pcap_next_ex continuoslly for a certain
time.

The handle has been configured like this (all the return checks removed from
this post)

char errbuf[100];

int bufferSize = BUFSIZ;

pcap_t *header = pcap_create(devs, errbuf);

pcap_set_snaplen(header, bufferSize);

pcap_set_promisc(header, 1);

pcap_set_timeout(header, -1);  //NO timeout

pcap_set_tstamp_type(header, PCAP_TSTAMP_ADAPTER);

pcap_set_immediate_mode(header,1);  /IMMEDIATE MODE!!!

pcap_activate(header);

 

I tested in a network where I have only regular traffic (ARP, MDNS,…) and
the packages are small (max length is 317 bytes!)

To have an idea of the load in the network:

50 packages in 20 secs!!!!

 

Using this loop:

while(1)

{

gettimeofday (&tvalBefore, NULL);

int status = pcap_next_ex(handle,&header, (const u_char **)&packet);

gettimeofday (&tvalAfter, NULL);

if(status == 1)

{

LOG the delta time

}

};

 

I get that the time required by pcap_next_ex to return a package can be
between 100us to more than 20 ms!!!!!

I tested with several different versions of pcap (1.4.0, 1.5.3 and the
latest 1.7.4) with the same result!

 

What is the explanation for this HUGE time range? 

I believe that I’m missing something very basic to get the package capturing
a lot faster but have no idea…..

Any help to understand this behaviour will be really appreciated because I’m
out of ideas to test!!

Regards

 

 

Tescik Ramos Aladro

Senior Software Architect

FMTP Power AB

Alströmerv. 23, 19144,SOLLENTUNA, SWEDEN

* +46708746885 

7 +46859084778

*  <mailto:tescik.aladro () fmtppower com> tescik.aladro () fmtppower com 

 <http://www.fmtppower.com/> www.fmtppower.com

FMTP™ “From Minus To Plus”

Engineering solutions and Consulting for the global Power Industry and other
Industries.

 

_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers