Re: high cpu load with tcpdump

[6bone%6bone.informatik.uni-leipzig.de@localhost]

On Fri, 26 Feb 2016, Christos Zoulas wrote:

> Date: Fri, 26 Feb 2016 14:52:46 +0000 (UTC)
> From: Christos Zoulas <christos%astron.com@localhost>
> To: current-users%netbsd.org@localhost
> Subject: Re: high cpu load with tcpdump
>
> In article <Pine.NEB.4.64.1602261452000.28151%6bone.informatik.uni-leipzig.de@localhost>,
> <6bone%6bone.informatik.uni-leipzig.de@localhost> wrote:
> > Hello,
> >
> > On my router tcpdump uses always 100% CPU.
> >
> >   PID USERNAME PRI NICE   SIZE   RES STATE      TIME   WCPU    CPU COMMAND
> >  3403 _tcpdump  38    0    19M 3016K RUN/6      0:24 98.08% 70.02% tcpdump
> >     0 root       0    0     0K 1182M CPU/7     49:35  0.00%  3.76% [system]
> >
> > The problem also occurs when tcpdump is listening on an interface
> > with no network traffic. Therefore, it can not be a load problem.
> >
> > The problem does not occur on all interfaces.
> >
> > ixg(0|1), bnx(0|1) and tap(0|1) are affected.
> >
> > lo0, stf0 and vlan* are not affected.
> >
> >
> > System is: NetBSD 7.0_STABLE
> >
> > Any idea what could be the problem?
> >
> >
> > Thank you for your efforts.
>
> ktrace please?
>
> christos

...
  5015      1 tcpdump  1456559035.621583576 CALL  read(3,0x7f7ff7b16000,0x80000)
  5015      1 tcpdump  1456559035.621593842 RET   read -1 errno 35 Resource temporarily unavailable
  5015      1 tcpdump  1456559035.621595938 CALL  read(3,0x7f7ff7b16000,0x80000)
  5015      1 tcpdump  1456559035.621598033 RET   read -1 errno 35 Resource temporarily unavailable
  5015      1 tcpdump  1456559035.621599849 CALL  read(3,0x7f7ff7b16000,0x80000)
  5015      1 tcpdump  1456559035.621601944 RET   read -1 errno 35 Resource temporarily unavailable
  5015      1 tcpdump  1456559035.621603690 CALL  read(3,0x7f7ff7b16000,0x80000)
  5015      1 tcpdump  1456559035.621605785 RET   read -1 errno 35 Resource temporarily unavailable
  5015      1 tcpdump  1456559035.621607601 CALL  read(3,0x7f7ff7b16000,0x80000)
  5015      1 tcpdump  1456559035.621609626 RET   read -1 errno 35 Resource temporarily unavailable
...

There are more than 150,000 read operations per second.
When a data packet is sent or received by the interface, the data packet 
is displayed correctly.


Regards
Uwe