On Wed, Aug 25, 2010 at 2:14 AM, Guy Harris wrote:
>
> On Aug 23, 2010, at 3:54 PM, Jim Lloyd wrote:
>
> > What is the relationship between the socket receive buffer and the
> > mmap buffer? Does the mmap buffer replace the socket receive buffer,
>
> Yes.
>
Cool.
> > I currently have my primar
On Aug 23, 2010, at 3:54 PM, Jim Lloyd wrote:
> What is the relationship between the socket receive buffer and the
> mmap buffer? Does the mmap buffer replace the socket receive buffer,
Yes.
> I currently have my primary testing
> machine configured with
>
> net.core.rmem_default = 4194304
> n
On Sun, Aug 22, 2010 at 11:44 PM, Guy Harris wrote:
>
> On Aug 21, 2010, at 3:30 PM, Jim Lloyd wrote:
>
> > I have tested with the above logic while sniffing traffic on a GigE
> ethernet
> > NIC (eth0) and on the loopback device (lo). The test machine is an 8-core
> > Opteron with 32Gb of RAM run
On Aug 22, 2010, at 11:44 PM, Guy Harris wrote:
> On Aug 21, 2010, at 3:30 PM, Jim Lloyd wrote:
>
>> Does this mean the 512Mb memory buffer is huge overkill?
>
> For this application, it might be.
Of course, we must bear in mind that the average human has one breast and one
testicle.[*] :-)
On Aug 21, 2010, at 3:30 PM, Jim Lloyd wrote:
> I have tested with the above logic while sniffing traffic on a GigE ethernet
> NIC (eth0) and on the loopback device (lo). The test machine is an 8-core
> Opteron with 32Gb of RAM running CentOS 5.5 with kernel 2.6.18. The traffic
> generator progra
I'm a little confused about the expected behavior of pcap_dispatch on linux
using libcpap 1.1.1. The initialization code I use (error handling omitted)
looks like this:
mChannel = pcap_create(device, errbuf);
int err = pcap_set_promisc(mChannel, int(promiscuous));
err = pcap_set_snapl
