PF_ring and friends: Options for making Linux suck less when capturing packets

[Petri Rosenström]

Hi,

I tried something like this with a wndr3800. I connected a usb powered
hdd (didn't test for speed, but if memory serves it's about
20megabytes).

Test 1.
Send some small (40 bytes) packages to the route (internal network ->
router (100 pkts/s))
run tcpdump -i eth1 -s 200 -w /some/usb/hdd.cap
Result 1.
It fills about 20kb/s of the memory. The CPU usage is about 100% from the start.

Test 2.
Send some small (40 bytes) packages to the route (internal network ->
router (20 pkts/s))
run tcpdump -i eth1 -s 200 -w /some/usb/hdd.cap
Result 2.
CPU usage about 80%. No noticeable memory consumption.

And of course if skipping the -s option from tcpdump there are no
issues with these network loads.

Best regards
Petri Rosenström