From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from bifrost.lang.hm (mail.lang.hm [64.81.33.126]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by huchra.bufferbloat.net (Postfix) with ESMTPS id 6C4FA21F1EC for ; Mon, 24 Mar 2014 16:16:47 -0700 (PDT) Received: from asgard.lang.hm (asgard.lang.hm [10.0.0.100]) by bifrost.lang.hm (8.13.4/8.13.4/Debian-3) with ESMTP id s2ONGjYg019185; Mon, 24 Mar 2014 15:16:45 -0800 Date: Mon, 24 Mar 2014 16:16:45 -0700 (PDT) From: David Lang X-X-Sender: dlang@asgard.lang.hm To: "Steinar H. Gunderson" In-Reply-To: <20140321164218.GA9261@sesse.net> Message-ID: References: <20140318145221.GA31327@sesse.net> <07BD4518-2A7E-4F43-8978-791E3B2BDA2A@cisco.com> <87eh1wc05c.fsf@toke.dk> <87a9ckbz1q.fsf@toke.dk> <871txvbre7.fsf@toke.dk> <20140321164218.GA9261@sesse.net> User-Agent: Alpine 2.02 (DEB 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: bloat@lists.bufferbloat.net Subject: Re: [Bloat] AQM creeping into L2 equipment X-BeenThere: bloat@lists.bufferbloat.net X-Mailman-Version: 2.1.13 Precedence: list List-Id: General list for discussing Bufferbloat List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 24 Mar 2014 23:16:47 -0000 On Fri, 21 Mar 2014, Steinar H. Gunderson wrote: > On Fri, Mar 21, 2014 at 03:39:16PM +0000, Dave Taht wrote: >>>> Is your hardware fast enough to run tcpdump -s 128 -w whatever.cap -i >>>> your interface during an entire rrul test without dropping packets? >>>> (on client and server) >> (question to list) Are there any options to tcpdump or the kernel to >> make it more possible to capture full packet payloads (64k) without >> loss at these speeds? tshark? > > You can capture tens of gigabits of traffic if you use the mmap packet ring > stuff. Doubt tcpdump supports it, but it wouldn't be impossible to do. > > I'm a bit confused if a normal machine these days can't easily saturate > gigabit (and capture it to SSD without further problems), though. I've been able to capture gigabit traffic with fairly normal CPUs (<3GHz), the key I found was to bypass all tcpdump processing at capture time, just write the raw packets out. I had a disk array on a medium quality FC card for this, but did the same thing with a 3ware 955x RAID card and a handful of SATA drives. David Lang