PF_ring and friends: Options for making Linux suck less when capturing packets
Petri Rosenström
petri.rosenstrom at gmail.com
Sat Nov 5 07:30:36 EDT 2011
Hi,
I tried something like this with a wndr3800. I connected a usb powered
hdd (didn't test for speed, but if memory serves it's about
20megabytes).
Test 1.
Send some small (40 bytes) packages to the route (internal network ->
router (100 pkts/s))
run tcpdump -i eth1 -s 200 -w /some/usb/hdd.cap
Result 1.
It fills about 20kb/s of the memory. The CPU usage is about 100% from the start.
Test 2.
Send some small (40 bytes) packages to the route (internal network ->
router (20 pkts/s))
run tcpdump -i eth1 -s 200 -w /some/usb/hdd.cap
Result 2.
CPU usage about 80%. No noticeable memory consumption.
And of course if skipping the -s option from tcpdump there are no
issues with these network loads.
Best regards
Petri Rosenström
More information about the Bloat-devel
mailing list