On Fri, 2011-05-20 at 12:02 -0700, Guy Harris wrote: > On Sep 6, 2010, at 11:45 AM, Doktor Bernd wrote: > > > If I recompile with the HAVE_PACKET_RING stuff *not* commented out I get > > the bad performance as with the packaged versions from Ubuntu. So the > > performance drop is caused by that part of libpcap. > > The packet-ring stuff has fixed-length slots, which means that the number of > slots is the buffer size divided by the size of the slots. > > The slot size is calculated from the snapshot length; what snapshot length > are you using? If, for example, this is on Ethernet, and your snapshot > length is > 1518 (1518 just in case the CRC is delivered as part of the > packet; it is with BPF in Mac OS X, for example, and I think on some other > BPF platforms, but it might not be on Linux), that might reduce the number of > ring buffer slots and thus increase the number of packet drops, especially if > the snapshot length is, for example, the tcpdump/Wireshark default of 65535.-
Are there alignment differences for the different buffer sizes? For example, when one would use 1518, would one be better-off using 1520 to end on a 4 byte boundary and so begin on a 4 byte boundary if these buffers are carved one after the other? rick jones - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
