Subject: Re: bpf/pcap performance
To: Michael Richardson <mcr@sandelman.ottawa.on.ca>
From: Darren Reed <darrenr@reed.wattle.id.au>
List: tech-net
Date: 04/08/2004 17:35:56
In some email I received from Michael Richardson, sie wrote:
-- Start of PGP signed section.
> 
> >>>>> "Darren" == Darren Reed <darrenr@reed.wattle.id.au> writes:
>     Darren> In testing on identical hardware, using an identical test
>     Darren> suite, I've observed 100% packet capture with freebsd 5.1
>     Darren> but netbsd 1.6zk always returned some packet loss (in this
>     Darren> instance, missing 1 packet is as bad as missing 10 or 100 or
>     Darren> 1000.)  On this particular piece of hardware, freebsd 5.1 is
>     Darren> returning 100% captures at upto 150Mb/s spread over 4 NICs
>     Darren> (2*Intel Pro100S, 2*Intel 1000MT.)
> 
>   A question - when you say 100% packet capture, you mean that you
> caught as many packets as you sent?

Yes, that we capture as many as we send.

>   I'm asking if it is that NetBSD is loosing packets, or that FreeBSD is
> failing to report them as lost.

The packet counting is done on what's returned in BPF buffers, the "lost
packet count" is ignored.

To answer some other questions,
* both FreeBSD 5.1 & NetBSD 1.6ZK have 1MB maximum BPF buffer sizes in
  the kernel.

* GENERIC kernels are being used - no modifications, no sysctl tuning.

* libpcap-2004-something is being used with pcap_setbuff to set the BPF
  buffer to 1MB

* The drivers are fxp (intel pro 100s), em (FreeBSD 1000MT) &
  wm (NetBSD 1000MT).

The packet loss in NetBSD occurs even if it is just single NIC to NIC,
at which the test driver (linux) tops out at 84Mb/s.

Darren