Subject: Re: non-standard way to capture network traffic
To: None <tech-kern@netbsd.org>
From: Vlad GALU <vladgalu@gmail.com>
List: tech-kern
Date: 09/25/2005 00:41:36
On 9/24/05, Zeljko Vrba <zvrba@globalnet.hr> wrote:
> Tonnerre wrote:
> >
> > This can probably be done easiest by using pf and pflogd. Just drop and
> > log all packets on the interface, and disable outgoing just for not hav=
ing
> > to bother with it. If the processor is fast enough...
> >
> It's a dual-CPU Xeon, each on 2GHz, and 3G RAM. Can I somehow take
> advantage of both CPUs?
>
> BTW, regarding disk writing speed.. Does somebody here know the rate at
> which zlib can compress data on this machine. I.e. could slow disk
> bandwidth be compensated with fast in-memory compression before writing?
>
> Thanks for answers.
>
>
>

 Since NetBSD uses an unified cache for I/O and VM, your disk writes
would get delayed a bit, no matter what way you write to your
filesystem (fill a mmap()-ed buffer or simple write() to a file
descriptor). At some point I got into the same problem. To a certain
load, writing to mmap()-ed files and msync()-ing them periodically did
the trick. As for compression, hmm, depends on what you want to write
(plaintext output or binary packet headers) and the amount of written
data. No one can give you exact figures. It's up to you to test and
decide.

--
If it's there, and you can see it, it's real.
If it's not there, and you can see it, it's virtual.
If it's there, and you can't see it, it's transparent.
If it's not there, and you can't see it, you erased it.