From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <shemminger@vyatta.com>
Received: from mail.vyatta.com (mail.vyatta.com [76.74.103.46])
	by huchra.bufferbloat.net (Postfix) with ESMTP id C5660200620
	for <bloat-devel@lists.bufferbloat.net>;
	Wed, 19 Oct 2011 09:52:47 -0700 (PDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by mail.vyatta.com (Postfix) with ESMTP id B97631410027;
	Wed, 19 Oct 2011 09:52:46 -0700 (PDT)
X-Virus-Scanned: amavisd-new at tahiti.vyatta.com
Received: from mail.vyatta.com ([127.0.0.1])
	by localhost (mail.vyatta.com [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id oTK3NeVCCNV4; Wed, 19 Oct 2011 09:52:46 -0700 (PDT)
Received: from nehalam.linuxnetplumber.net
	(static-50-53-80-93.bvtn.or.frontiernet.net [50.53.80.93])
	by mail.vyatta.com (Postfix) with ESMTPSA id B39471410004;
	Wed, 19 Oct 2011 09:52:45 -0700 (PDT)
Date: Wed, 19 Oct 2011 09:52:44 -0700
From: Stephen Hemminger <shemminger@vyatta.com>
To: Dave Taht <dave.taht@gmail.com>
Subject: Re: PF_ring and friends: Options for making Linux suck less when
	capturing packets
Message-ID: <20111019095244.27354f74@nehalam.linuxnetplumber.net>
In-Reply-To: <CAA93jw7os4NkvyU_33422H6Ag=6diipPnQ5cfSnUoen+eUYO9Q@mail.gmail.com>
References: <CAA93jw7os4NkvyU_33422H6Ag=6diipPnQ5cfSnUoen+eUYO9Q@mail.gmail.com>
Organization: Vyatta
X-Mailer: Claws Mail 3.7.10 (GTK+ 2.24.6; x86_64-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Cc: bloat-devel <bloat-devel@lists.bufferbloat.net>
X-BeenThere: bloat-devel@lists.bufferbloat.net
X-Mailman-Version: 2.1.13
Precedence: list
List-Id: "Developers working on AQM, device drivers,
	and networking stacks" <bloat-devel.lists.bufferbloat.net>
List-Unsubscribe: <https://lists.bufferbloat.net/options/bloat-devel>,
	<mailto:bloat-devel-request@lists.bufferbloat.net?subject=unsubscribe>
List-Archive: <https://lists.bufferbloat.net/pipermail/bloat-devel>
List-Post: <mailto:bloat-devel@lists.bufferbloat.net>
List-Help: <mailto:bloat-devel-request@lists.bufferbloat.net?subject=help>
List-Subscribe: <https://lists.bufferbloat.net/listinfo/bloat-devel>,
	<mailto:bloat-devel-request@lists.bufferbloat.net?subject=subscribe>
X-List-Received-Date: Wed, 19 Oct 2011 16:52:47 -0000

On Wed, 19 Oct 2011 18:44:08 +0200
Dave Taht <dave.taht@gmail.com> wrote:

> Currently I can do tcpdump -i eth1 -s 200 -w /some/usb/stick.cap at about
> 1.2 - 2MB/sec before saturating cpu on the wndr3700v2. (MB =megabyte)
> 
> I can r/w a usb stick at about 8/7 MB/sec. I haven' tried a 'real' hard
> disk.
> 
> About 50Mbit/sec I figure covers the 95 percentile of most home users to
> their ISP. 100Mbit would be better. Being drop-free would be really helpful
> on shorter tests....
> 
> I was also thinking about an in-kernel module that uses 'splice' to send the
> data to a file... as well as  the current jit work for bpf, using netfilter,
> and various other alternatives.
> 
> Or writing something in a iptables or tc filter to track things more sanely
> that web100 does....
> 
> Ideas?

USB sticks are real slow. Even some infinitely fast capture isn't going
to get around that.  Get a real SSD and put it in enclosure that supports
USB 3.0?