just trying to figure out why do I have packet losses with flow-capture
daemon in spite of the fact that I have fast machine and not much of the
traffic (without interface errors on routers), I found the following code
snippet in flow-capture.c (version 0.67 of flow tools):
/* socket to receive flow pdu exports */
if ((ftnet.fd = socket(AF_INET, SOCK_DGRAM, 0)) < 0)
fterr_err(1, "socket()");
if (bigsockbuf(ftnet.fd, SO_RCVBUF, FT_SO_RCV_BUFSIZE) < 0)
fterr_err(1, "bigsockbuf()");
with #define FT_SO_RCV_BUFSIZE (4*1024*1024)
now, if I understand the black magic in bigsockbuf(), it should
(portably?) increase the default buffer size value to FT_SO_RCV_BUFSIZE
if possible or to the max buffer value for the system in question.
on my 2.4.27 linux box, I had this max value equal to 900000
(net.core.rmem_max). in my system logs I found the line like
.... flow-capture[20308]: setsockopt(size=4194304)
which should confirm that my receive buffer has 4194304 bytes
(or maybe 2 times more, see below). however, this is not possible, since
the system won't give me more than net.core.rmem_max, i.e. 900000.
now, I wrote the small test program which essentially looks like this
(I modified slightly bigsockbuf so that I don't need custom syslog
functions):
--------------------------------------------------------------------------
#define FT_SO_RCV_BUFSIZE (4*1024*1024)
int bigsockbuf(int fd, int dir, int size);
int main (void)
{
int fd, size, rval, n, len;
len = sizeof(n);
fd = socket(AF_INET, SOCK_DGRAM, 0);
printf("socket returned: %d\n", fd);
rval = getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &n, &len);
printf("getsockopt returned: %d, receive buffer size: %d\n", rval, n);
size = bigsockbuf(fd, SO_RCVBUF, FT_SO_RCV_BUFSIZE);
printf("bigsockbuf returned: %d\n", size);
rval = getsockopt(fd, SOL_SOCKET, SO_RCVBUF, &n, &len);
printf("getsockopt returned: %d, receive buffer size: %d\n", rval, n);
}
--------------------------------------------------------------------------
at first, I had the net.core.rmem_max set to 900000. running the test
program yields
$ ./sso
socket returned: 3
getsockopt returned: 0, receive buffer size: 107520
info setsockopt(size=4194304)
bigsockbuf returned: 4194304
getsockopt returned: 0, receive buffer size: 1800000
so, bigsockbuf happily returns 4194304 bytes, while in fact we have 1800000
(the factor 2 compared to 900000 I still don't understand).
after I increased the net.core.rmem_max to 10000000, I get:
$ ./sso
socket returned: 3
getsockopt returned: 0, receive buffer size: 107520
info setsockopt(size=4194304)
bigsockbuf returned: 4194304
getsockopt returned: 0, receive buffer size: 8388608
so, now we should have enough. appart from the fact that linux default
buffer size is ridiculously small, the problem is that bigsockbuf() does not
complain that we got less than that in the case when net.core.rmem_max is
set to a lower value.
oh yes, the reason which lead me to all this was
$ netstat -s | grep buf
6 packets pruned from receive queue because of socket buffer overrun
502 packets collapsed in receive queue due to low socket buffer
any comments anyone? Mark?
cheers,
Kresimir
_______________________________________________
Flow-tools mailing list
[EMAIL PROTECTED]
http://mailman.splintered.net/mailman/listinfo/flow-tools
