Hi, back from vacation I had some time to test libpcap again
> > thanks for the advice. If I use libpcap 1.1.1 compiled with the > > HAVE_PACKET_RING stuff commented out, the my softare performs very well. > > Ubuntu currently ships with 1.0.0.6 I think. If I use that version my > > application has problems capturing 100 Mbit/s of traffic. If I change to > > the custom build version of libpcap then I can capture 1 Gbit/s of traffic > > and problem occur only for small packet sizes (<100 Byte). > > What happens if you build 1.1.1 with no changes (i.e., with the > HAVE_PACKET_RING stuff *not* commented out) and use that version? That's the > cleanest test of mmap vs. non-mmap. If I recompile with the HAVE_PACKET_RING stuff *not* commented out I get the bad performance as with the packaged versions from Ubuntu. So the performance drop is caused by that part of libpcap. > > Any idea why mmap is slowing everything down? I am using pcap_dispatch to > > capture packet by packet. > > (That means you're not using pcap_next() or pcap_next_ex(), correct?) correct > What are you passing as the second argument to pcap_dispatch()? 1 > And how are you measuring the packet loss? Are you using the figures from > pcap_stats(), or are you determining in some other fashion that packets > weren't captured?- I am generating my own packets and compare sent vs. received numbers. For generating the packets another PC is used. Bernd - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.