Subject: Re: bpf/pcap performance
To: None <ragge@ludd.luth.se>
From: Darren Reed <darrenr@reed.wattle.id.au>
List: tech-net
Date: 04/08/2004 17:41:57
In some email I received from ragge@ludd.luth.se, sie wrote:
> >
> > Does anyone know why using bpf/pcap would drop packets when running
> > netbsd as opposed to freebsd ?
> >
> Be sure that you have increased bpf_bufsize to some reasonable value,
> instead of the default. I have no problem capturing data at 1Gbit
> speed using an 1MB buffer.
Which card/driver is this with ? And what sort of PC ?
We're using a 2.4GHz P4, 256MB RAM, RDRAM, etc.
Are you storing to disk or just capturing to RAM buffers and then
throwing away ?
(We're also saving to disk.)
Oh, there is one other angle I should mention:
* the application is threaded, one thread uses select over all the
NICs so it knows when to read data from BPF, the other writes to
disk.
Darren