[tcpdump-workers] Request new DLT value for Infiniband link

2012-11-11 Thread Oren Kladnitsky
Hi, I'd like to request a new DLT/LINKTYPE value for Infiniband traffic (DLT_INFINIBAND). Infiniband spec is available at: http://members.infinibandta.org/kwspub/spec/V1r1_2_1.Release_12062007.zip (registration required). See "Chapter 5.: Data packet format" for the packet layout. LRH (Local Rout

[tcpdump-workers] mmap consumes more CPU

2012-11-11 Thread abhinav narain
hi, I just checked the two mechanism : (1) Using mmap to fetch packets from kernel to userspace (2) Using recvfrom() call to fetch packets I see top reports (1) 34% memory 20% cpu usage (2) 21% memory 7% cpu usage ! I wanted a performance improvement using mmap but I am slowing my small router

[tcpdump-workers] regarding usage of recv calls in mmap code

2012-11-11 Thread abhinav narain
hi I wanted to know why is MSG_PEEK used in the recv() call in mmap code and not recvfrom() with MSG_TRUNC flag. The reason i am asking is .. because I see my code takes a lot of CPU which is due to more looping, I suppose. The flag description for MSG_PEEK shows it doesn't disc

Re: [tcpdump-workers] vlan tagged packets and libpcap breakage

2012-11-11 Thread Bill Fenner
On Wed, Oct 31, 2012 at 6:20 PM, Guy Harris wrote: > > On Oct 31, 2012, at 2:50 PM, Ani Sinha wrote: > >> pcap files that already have the tags reinsrted should work with >> current filter code. However for live traffic, one has to get the tags >> from CMSG() and then reinsert it back to the pack

Re: [tcpdump-workers] Request new DLT value for Infiniband link

2012-11-11 Thread Guy Harris
On Nov 11, 2012, at 4:53 AM, Oren Kladnitsky wrote: > I'd like to request a new DLT/LINKTYPE value for Infiniband traffic > (DLT_INFINIBAND). > Infiniband spec is available at: > http://members.infinibandta.org/kwspub/spec/V1r1_2_1.Release_12062007.zip > (registration required). > See "Chapter

Re: [tcpdump-workers] regarding usage of recv calls in mmap code

2012-11-11 Thread Guy Harris
On Nov 7, 2012, at 10:28 AM, abhinav narain wrote: > I wanted to know why is MSG_PEEK used in the recv() call in mmap code > and not recvfrom() with MSG_TRUNC flag. > The reason i am asking is .. because I see my code takes a lot of CPU which > is due to more looping, I suppose. > The flag des

Re: [tcpdump-workers] PCAP file questions...

2012-11-11 Thread Guy Harris
On Nov 11, 2012, at 2:55 PM, barcaroller wrote: > The libpcap C API provides functions for writing (pcap_dump) and reading > (pcap_next) a PCAP file. I have two questions: > > - How do I remove a packet from a PCAP file using the libpcap C API? You can't remove a packet from an existing file

Re: [tcpdump-workers] mmap consumes more CPU

2012-11-11 Thread Guy Harris
On Nov 5, 2012, at 11:03 AM, abhinav narain wrote: > I just checked the two mechanism : > (1) Using mmap to fetch packets from kernel to userspace > (2) Using recvfrom() call to fetch packets > > I see top reports > (1) 34% memory 20% cpu usage > (2) 21% memory 7% cpu usage ! > > I wanted a p

Re: [tcpdump-workers] PCAP file questions...

2012-11-11 Thread Guy Harris
On Nov 11, 2012, at 5:44 PM, barcaroller wrote: > On 2012-11-11 23:27:00 +, Guy Harris said: > >> They could, in principle, be appended to, but that can't be done with the >> existing APIs - you'd need an "open for appending" call, which would, unlike >> the "create a new file" calls (pca