Hi, First off let me just say that I'm a novice at NTop, I've been building custom probe software on top of libPCAP. I have been studying some NTop code and I have a question w.r.t. to the use of libPCAP. I see that the callback given to libPCAP is 'queuePacket' which internally calls 'processPacket' which actually does some work. I would have expected that 'queuePacket' would only memcpy() the packet bytes and put them in a queue so that another thread can process the packets further.
I believe that just 'queueing up' packets might provide some performance optimization as the PCAP callback should do as little work as possible to avoid packet loss. Please correct me if I am wrong on this. Packet loss might be greater on platforms like Solaris which do not support kernel level filters for packets. In this case libPCAP uses DLPI to read from the NIC card and then does the filtering itself, i.e. libPCAP may already be taking some user CPU before the PCAP callback is called on Solaris. This increases chance of packet loss. In Linux, as the packet filtering would be done in the kernel, it will take more system CPU and a minimal amount of user CPU so doing the extra processing in the PCAP callback might be okay. However, I still believe that the best thing to do is to queue packets from libPCAP right away to minimize loss. I haven't tested this theory out yet, but before I proceed I'd like to check if someone else has done some R&D along these lines. Thanks. Regards, Porus
_______________________________________________ Ntop-dev mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-dev
