Re: [Pandora] offtopic: libpcap performance

[Simon Patarin]

Hi,

> do you know docs/whatever good info about packet capturing using libpcap
> with different platforms?

No, not really. All i can tell you about is my own experience. With Linux,
not using mmaped socket when available is a real waste (that's the biggest
modification I've made to the libpcap I distribute with Pandora). With
*BSD (bpf driver), the default buffer size used is really too small,
personnaly I've found 4MB to be appropriate for 100Mb/s links. The same
applies for OSF/Tru64 (pf driver). In summary, with processors of
reasonnable speed (above 1GHz), a 66 MHz PCI bus and the previous
modifications, it's easy to handle 100Mb/s (maybe much more than that)  
with any of the platforms mentioned above. The last FreeBSD kernel
includes network adaptator polling support (there are patches to the
Linux kernel floating around to do the same thing -- look at the Click
project page for example: http://pdos.lcs.mit.edu/click/), I think this
kind of tricks are necessary to handle much higher speeds as the cost of
interrupts processing becomes the bottleneck.

> by the way I found lipcap-0.7 has to make an extra syscall for each packet
> in order to get it's timestamp...
> 
> That is: one packet -> 2 syscalls
> 
> I think libpcap with *BSD just makes one syscall for sevaral packets
> with timestamps

That's too bad! However, Linux mmaped sockets follow the same behaviour as
BSD: one syscall for several packets.

Simon