On Tue, Feb 11, 2003 at 02:31:56PM +1100, Shaun wrote: > I notice that on AIX during the BPF buffer size selection loop (BIOCSBLEN) > the buffer size ends up being around 16k. For those of us who aren't > particularly familiar with the buffers used on other platforms is this > small a value normal?
Currently, the code starts at 32K; on some platforms, such as NetBSD, that's the maximum buffer size available. The BPF code starts at 32K and keeps trying smaller sizes, dividing by half, until it's allowed to do a BIOCSBLEN and a BIOCSETIF to set the size to the specified value. If it ends up being around 16K, that means that 32K doesn't work and 16K does; perhaps that's all the buffering AIX lets you have. > By my calculations this space will be filled about > 78 times a second on a busy 10MB Ethernet. How can I hope to keep up with > the traffic on the network at this sort of rate? By reading from the buffer 78 or more times a second. That requires that you take less than ~.0128 seconds to handle 16K worth of packets, including waking up, reading the packets, and processing them. All that a bigger buffer does is reduce the amount of time spent doing wakeups and per-system-call overhead for reads, by letting you do fewer reads. If that's not the bottleneck, a bigger buffer ultimately won't help unless you capture for a time short enough to fill only the kernel's buffer; the expectation is that an application might well keep capturing, not that the kernel's buffer will always be large enough for all captures. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
