Hi,
Sorry if my mail was ambiguous, I guess I just wanted to share my theory first
and check if someone agreed. I'm not very familiar with NTop code, I might try
it with my own applications and share the results. Thanks.
Regards,
Porus
________________________________
From: Luca Deri <[email protected]>
To: [email protected]; Porus Mehta <[email protected]>
Sent: Saturday, 17 December 2011 2:28 PM
Subject: Re: [Ntop-dev] A question on Ntop behaviour w.r.t. libPCAP
Porus
I agree with you. What I have not understood is the message you want to give.
If you have some suggestions for improving the performance, please code them
and send us the patches
Thanks Luca
On Dec 17, 2011, at 7:42 AM, Porus Mehta wrote:
> Hi,
>
> First off let me just say that I'm a novice at NTop, I've been building
> custom probe software on top of libPCAP. I have been studying some NTop code
> and I have a question w.r.t. to the use of libPCAP. I see that the callback
> given to libPCAP is 'queuePacket' which internally calls 'processPacket'
> which actually does some work. I would have expected that 'queuePacket' would
> only memcpy() the packet bytes and put them in a queue so that another thread
> can process the packets further.
>
> I believe that just 'queueing up' packets might provide some performance
> optimization as the PCAP callback should do as little work as possible to
> avoid packet loss. Please correct me if I am wrong on this.
>
> Packet loss might be greater on platforms like Solaris which do not support
> kernel level filters for packets. In this case libPCAP uses DLPI to read from
> the NIC card and then does the filtering itself, i.e. libPCAP may already be
> taking some user CPU before the PCAP callback is called on Solaris.
>
> This increases chance of packet loss. In Linux, as the packet filtering would
> be done in the kernel, it will take more system CPU and a minimal amount of
> user CPU so doing the extra processing in the PCAP callback might be okay.
>
> However, I still believe that the best thing to do is to queue packets from
> libPCAP right away to minimize loss. I haven't tested this theory out yet,
> but before I proceed I'd like to check if someone else has done some R&D
> along these lines. Thanks.
>
> Regards,
> Porus
> _______________________________________________
> Ntop-dev mailing list
> [email protected]
> http://listgateway.unipi.it/mailman/listinfo/ntop-dev
---
Keep looking, don't settle - Steve Jobs
_______________________________________________
Ntop-dev mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-dev
