Hello,
I am developing a sniffer application using LIB PCAP in order to grab some
packets from the network and to decode them.
This application is running on a SUN platform (Solaris 2.6).
I am using a powerful NETRA 1400 with 4 processor and 4 Gbytes of memory.
The interface Ethernet card is a 100 Mbps.
I noticed that some packets are lost even when running at a low rate.
I tried different traffic rates from 1 Mbps to 3.3 Mbps but the problem
still remain.
In order to troubleshoot this problem, I created a small program in order
to limit the processing to the strict minimum. The program is grabbing a
predefined number of packets ( 200 000 packets) from the interface by using
LIB PCAP (I tried versions 0.6.2 and 0.7.1) and store them in memory in a
large buffer.
After reading the total packets count, the program close the PCAP session
and then dumps the packets into a binary file.
The binary file is then analyzed by another application running PCAP in
Offline mode but the application shows each time that some packets are
still missing.
Of course, this phenomenon is amplified when increasing the traffic rate.
I tried to use "pcap_dispatch" instead of "pcap_loop" subroutine to Collect
and processes packets but it does not help. I incremented also the task
priority of the program with NICE to -20 (maximum value that can be set in
super user mode with NICE).
I don't understand why some packets are lost at a such low rate.....
I can provide more details on the program to grab but it is really simple.
I tried also with TCPDUMP by writing the packets into a binary file and to
replay it with my application. TCPDUMP missed also some packets in the same
way (even more since there is more processing : TCPDUMP is reading and
writing into a file on each packet. ).
I don't know at this time if the packets are dropped at the interface level
or PCAP level.
I would really appreciate if somebody can tell me if there is some current
limitations with PCAP on a SUN box or aware of any type of issues ?
I am also interested to know what could be the performances (traffic rate)
supported on a SUN box for a 100 Mbps interface card.
I wonder also if there is any particular tuning that can be done at the
system level (Kernel / Unix) that could fix my problem.
I don't know at this time if the packets are dropped at the interface level
or PCAP level.
Is there any tool or UNIX command that can help me to figure where the
packets are lost ?
According the the PCAP stats (number of packets dropped, interface drops)
the counters show 0, but I am not sure that they are implemented in PCAP
code.
I will appreciate some help or suggestions.
Thank you.
Regards,
Alain.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
