-[ Mon, Feb 07, 2011 at 06:40:40PM +0100, ri...@happyleptic.org ]
> And I also experienced a huge packet drop whenever the throughput raised
> above 50MB/sec (up to 100MB/sec). By huge, I mean almost 50% of total
> received packets (ie. one third of the packets were lost according to
> pcap sta
I've been using Squeeze libpcap (ie. 1.1.1) to capture some traffic from
a gigabit ethernet adapter today, connected straight to another gigabit
adapter of another host that was sending a pcap file with tcpreplay.
receive buffer was resized up to 60Mb (with proper rmem_max).
And I also experienced
thank you all for your comments,
> I see code for tpacket support in the 2.4.20 source (two dot four dot twenty,
>not two dot six dot anything);
> I think it dates back before then (perhaps 2.4.0). It requires
>CONFIG_PACKET_MMAP.
i checked inside "/proc/net/ptype" on 2.6.26 while running tcp
On Feb 6, 2011, at 10:07 PM, Luca Bruno wrote:
> I can't speak for Lenny, but it looks like Squeeze (which was released
> a couple of days ago) has both:
> * http://packages.debian.org/squeeze/libpcap0.8
Ah, so Squeeze has the libpcap 1.1.1 version of libpcap 0.8. :-)
(Yes, it makes no sense to
Guy Harris scrisse:
> You need at least libpcap 1.0.0 to have tpacket ("turbo-packet",
> right?) support in the standard libpcap. You could also get it with
> the Phil Wood patches he mentioned, although that only supports
> memory-mapped access on Linux, not FreeBSD - but he's using Linux, so
>
On Jan 31, 2011, at 10:56 AM, Jesper Dangaard Brouer wrote:
> M. V. yahoo.com> writes:
>
>> so, i dont know what else to do, seems like nothing works for me :-S
>> 1) does anyone have any other suggestions that may help?
>> 2) about MMAP support in Debian kernel: i installed Debian5.0.3 from
>
M. V. yahoo.com> writes:
> so, i dont know what else to do, seems like nothing works for me :-S
> 1) does anyone have any other suggestions that may help?
> 2) about MMAP support in Debian kernel: i installed Debian5.0.3 from original
> ISO file. does anyone know if MMAP exists in its kernel by
hi,
thank you all for your answers, sorry that for the delay on my reply, i wasn't
at work on Tuesday.
i tested your suggestions but got no luck at all.
from your posts, i got 4 different approaches to my problem:
1) i reset kernel parameters as what Gabe suggested, but i got no changes in
res
Quick guess : maybe you build a custom kernel without the option to enable mmap
sharing of packets with userland ?
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
The best way I found to do this was to have the application that is receiving
the packets running on the same cores that the kernel is pulling them off the
nic. Since my machine had two chips each with 4-6 cores (8-12 logical
cores), I limited my application to run on the same chip as the nic was
Maybe you use a custom kernel lacking the option to enable mmap sharing
of packets from kernel to userland ?
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
squeeze the most performance possible out of my
application.
- Gabe Black
-Original Message-
From: tcpdump-workers-ow...@lists.tcpdump.org
[mailto:tcpdump-workers-ow...@lists.tcpdump.org] On Behalf Of M. V.
Sent: Sunday, January 23, 2011 9:42 AM
To: tcpdump-workers
Subject: [tcpdump-worker
hi guys,
i'm stucked with a confusing problem. i'm trying to dump gigabit network
traffic
to file. i'm using Debian5.0.3 AMD64 on an HP Proliant DL360 G5 (2*Quad-Core
2.33 hz - 4GiB RAM - 2*76GiB HardDisk). but whatever i try, even at 600Mbps
rate, i got a huge packet-drop.
*) i tried both tc
13 matches
Mail list logo
