Re: [tcpdump-workers] [PATCH] Improvement of behaviour when -s 0 is used

2011-12-12 Thread Magnus Gille
Sorry Guy, My emails got stuck when the mailing list went down and I didn't get anything so I ended up sending it twice. Thanks for your comments. //Magnus On Sun, Dec 11, 2011 at 2:33 PM, Guy Harris wrote: > > On Oct 14, 2011, at 2:51 PM, Magnus Gille wrote: > > > I came across an issue with

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-12 Thread Guy Harris
On Dec 12, 2011, at 1:41 PM, Guy Harris wrote: > On Dec 12, 2011, at 3:59 AM, David Laight wrote: > >> I also think that interface could defer freeing the last >> rx buffer until the request to read another packet. >> That would avoid the necessity of a buffer copy >> for applications that don't

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-12 Thread Guy Harris
On Dec 12, 2011, at 1:18 PM, abhinav narain wrote: > Its KB then, because the router has 64MB RAM > So, it means, I am filling the buffer almost always. No, what it means is "the process running your application has a 9.3MB virtual address space", which says nothing about how much RAM it's usin

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-12 Thread Guy Harris
On Dec 12, 2011, at 1:10 PM, drag...@durandal.kismetwireless.net wrote: > About the only time you'll see beacons on non-basic rates is a > greenfield deployment, of which I've *never* found one in the wild > despite all the manufacturers caring about it. Will we see any greenfield deployments an

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-12 Thread Guy Harris
On Dec 12, 2011, at 3:59 AM, David Laight wrote: > The linux libpcap has a poll() in the 'memory mapped' > kernel interface (in order to check for errors). > If the application is using poll() this is an unnecessary > system call. The only way libpcap can infer that the application is using poll

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-12 Thread dragorn
On Mon, Dec 12, 2011 at 12:53:38PM -0800, Guy Harris wrote: > > Will I ever see HT40+,40- in case of beacons. > > Probably not. > > > Does this field in radiotap header (if it occurs) mean the interface beacon > > came from was having the above (equivilantly n ) support ? > > No. This field i

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-12 Thread abhinav narain
> > > > VSZ reports 9304 Bytes.I think this must be virtual address space. > > 9394 *bytes*? That's 15% of about 62KB; if that's 15% of your RAM, you're > probably running on a machine with 64K, which I doubt. > > Did you mean 9394KB? top, at least on my machine (running Mac OS X), > reports vari

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-12 Thread Guy Harris
On Dec 12, 2011, at 1:36 AM, abhinav narain wrote: > I can't find any default buffer size in pcap, The default size is platform-dependent. On Linux systems that support memory-mapped capture (in both the kernel, which your kernel does, and in libpcap, which libpcap 1.0 and later do), the defa

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-12 Thread Guy Harris
On Dec 12, 2011, at 12:31 AM, abhinav narain wrote: > I see this usage by top command. > VSZ reports 9304 Bytes.I think this must be virtual address space. 9394 *bytes*? That's 15% of about 62KB; if that's 15% of your RAM, you're probably running on a machine with 64K, which I doubt. Did you

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-12 Thread David Laight
> Is poll() better than select ? poll() and select() use the same basic kernel code. poll() is generally better since it doesn't have problems with high numbered fds, and doesn't require a sparse fd map to be scanned. The linux libpcap has a poll() in the 'memory mapped' kernel interface (in or

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-12 Thread abhinav narain
>> itself, as specified by pcap_set_buffer_size()? > >> > > Yes, I havent user the pcap_set_buffer_size(), but in open_live() , i > give the buffersize as BUFSIZ, > > > There is no buffer size option in pcap_open_live(), so you *can't* give > the buffer size in a pcap_open_live() call. > > I can't

Re: [tcpdump-workers] capturing on both interfaces simultaneously

2011-12-12 Thread abhinav narain
On Sun, Dec 11, 2011 at 9:04 PM, Gianluca Varenni < gianluca.vare...@riverbed.com> wrote: > When you talk about 15% RAM, do you actually mean working set or virtual > address space? Which version of linux are you using? > > I am using Openwrt on a Netgear router. Kernel 2.6.39 I see this usage by