3 ms·
I wonder if this would work with PF_RING[1] from the ntop guys? Regular libpcap drops packets quite a bit at 10G+ speeds when you have adaptive coalescing disab
by SEJeff 13y ago
I wonder if this would work with PF_RING[1] from the ntop guys? Regular libpcap drops packets quite a bit at 10G+ speeds when you have adaptive coalescing disabled on the network card.
[1] http://www.ntop.org/products/pf_ring/ http://www.ntop.org/products/pf_ring/
- packetbeats 13y agoPF_RING is an option but it requires a kernel module and specific network cards. Before then, the memory map sniffing feature of the Linux kernel [1] can improve libpcap performance. Not quite to 10G speeds, though, but I think enough for most cases :-) [1]: http://www.cs.fsu.edu/~baker/devices/lxr/http/source/linux/Documentation/networking/packet_mmap.txt http://www.cs.fsu.edu/~baker/devices/lxr/http/source/linux/D...
- SEJeff 13y agoAny plans to support it? Part of my job (historically) has been building line rate pcap appliances that do pcaps at nanosecond resolution (using endace cards, Mellanox, or solarflare). PF_RING is a bit tricky to get working, but is completely flawless when you get it running. This software looks fantastic however.