Subject: Re: bpf/pcap performance
To: None <ragge@ludd.luth.se>
From: Darren Reed <darrenr@reed.wattle.id.au>
List: tech-net
Date: 04/08/2004 17:41:57
In some email I received from ragge@ludd.luth.se, sie wrote:
> > 
> > Does anyone know why using bpf/pcap would drop packets when running
> > netbsd as opposed to freebsd ?
> > 
> Be sure that you have increased bpf_bufsize to some reasonable value, 
> instead of the default. I have no problem capturing data at 1Gbit
> speed using an 1MB buffer.

Which card/driver is this with ?  And what sort of PC ?

We're using a 2.4GHz P4, 256MB RAM, RDRAM, etc.

Are you storing to disk or just capturing to RAM buffers and then
throwing away ?
(We're also saving to disk.)

Oh, there is one other angle I should mention:

* the application is threaded, one thread uses select over all the
  NICs so it knows when to read data from BPF, the other writes to
  disk.

Darren