There are other factors as well:
1. Number of processors and processor speed.
2. Amount of RAM
3. Operating system workload
4. Network Adapter Task Offloading capability (esp. checksum offloading)
5. Speed of disk subsystem
On an modern fast quad-core system that is relatively idle (has no other work
to do) with lots of RAM and a high performance multi-disk RAID-0 array and with
checksum offloading enabled in the adapter, it should be entirely possible to
capture a gigabit speed without packet loss.
If your system is an overtaxed (busy) single processor system with only an
average amount of RAM and an average speed non-RAID disk subsystem however,
then you’re very likely going to experience significant packet loss beyond
about 480 Mbps.
--
"Fish" (David B. Trout)
[email protected]
From: [email protected]
[mailto:[email protected]] On Behalf Of yulou liu
Sent: Sunday, September 19, 2010 12:50 AM
To: [email protected]
Subject: [Winpcap-users] About the packets loss , what is the bottleneck ?
Importance: High
There is still the question about packets loss.
According to the essay ' Profiling and Optimization of Software-Based
Network-Analysis Applications' , every packet is copied twice in the main
memory before reaching the user. In order to reduce the cost of CPU and the
bus occupying of the SDRAM of pc, is it possible to copy data directly from
the kernel buffer to the final buffer , which I want the date kept in ?
Here is another idea --- allocate several different user buffers , once a user
buffer is fulled , then let the next user buffer to save the new datas from
kernel buffer. Meanwhile copy datas from the first user buffer to disk (assume
that the hard disk write rate is fast enough). Is this idea work with the
winpcap ?
Thank you!
==============================================================
Q1: tough question to answer, as it depends on a number of factors. What is the
average packet size? Are you just counting the packets, or dumping them to
disk/DB/...? Do you see packet drops in the pcap_stats?
Q2: I will need to run some tests on this. Do you have some minimal sample code
that shows the issue?
Q3: Yes, *if* the NIC (and NIC driver) are not dropping packets themselves.
Did you disable any protocol bound to the NIC where you receive all these
packets?
Have a nice day
GV
From: yulou liu
Sent: Wednesday, August 25, 2010 11:08 AM
To: winpcap
Subject: [Winpcap-users] About the packets loss , what is the bottleneck ?
I'm using winpcap to capture datas from FPGA board via 1G Ethernet
connection(directly connected).
the FPGA is configed to send data at a special rate. With the fpga sending
rate increases,especially above 500Mbps, it sometimes loss packets.
Q1: Is it possible to totally avoid packets loss by optimism the code? I want
to collect datas at speed 614Mbps without packet loss (collecting all datas
last about 1 minutes). My workstations features with 2 Xeon CPU (each has
4core), DDR3 SDRAM, 1 G onboard netcard. Which part is the most probably
bottleneck ?
Q2: As a test , I found the pcap_next_ex() can't get any packets when the
user buffer is set over 64 MB, what does it happen ?
Q3: if the Kernel buffer's size is 16MB , then the first 16Mb packets from fpga
won't be lost, so , if I set the kernel buffer as 128MB , then at least
the first coming 128MB data from FPGA won't be lost either ? but I found When
I set the kernel buffer bigger than 100 MB, the packets drops is getting
worse.
Thanks a lot!
_______________________________________________
Winpcap-users mailing list
[email protected]
https://www.winpcap.org/mailman/listinfo/winpcap-users
