I've been running performance tests against pcap_next_ex() and
pcap_dump(). I've placed micro-second timers around both functions and
sent millions of packets to my test programs.
Both functions performed admirably over a short period of time (up to 8
Gbits/sec) but, as time progressed, both functions became increasingly
slower until the data rate dropped to 200 Mbits/sec.
Please note that the two functions become slower even when I read/wrote
new pcap files (i.e. I would close a pcap file and start
reading/writing a new PCAP file, but the performance still remained
low). At no time did the size of these pcap files exceed 100MB. Only
when I re-started the test programs did the performance go up again.
It's as if there is a process-wide global resource, independent of the
pcap files, that gets used up by pcap_next_ex() and pcap_dump() as the
process is running.
Does anyone know how to explain this?
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
