On Aug 22, 2015, at 8:06 PM, barcaroller <barcarol...@gmail.com> wrote:
> It has puzzled me too. Keep in mind that I am making millions of these pcap > calls; only one of them could be taking 2 seconds. Then the average might be more interesting than the maximum. > I actually read the packets from a pcap file (not part of the test), store > the packets in memory (e.g. 50,000 packets), then write them in a loop to > disk (e.g. 50,000 x 1,000) using multiple pcap files (none greater than > 100MB); this is phase 1. So does "50,000 x 1,000" mean that it writes out each packet 1,000 times? So the reading of the file in phase 1 isn't being tested, so the pcap_next_ex() calls being performance-tested are in phase 2? > I then read all packets (e.g. 50,000 x 1,000) in chunks and destroy each > chunk before reading the next; this is phase 2. "In chunks" meaning that you have a loop that reads a chunk worth of packets, with each packet read with pcap_next_ex(), and then free all the packets in the chunk before reading the next chunk? > Right. But something in the process is making pcap_next_ex() and pcap_dump() > slower with time. Something *somewhere* is. _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
