PF_ring and friends: Options for making Linux suck less when capturing packets

[Jim Gettys]

On 10/19/2011 12:44 PM, Dave Taht wrote:
>
> Currently I can do tcpdump -i eth1 -s 200 -w /some/usb/stick.cap at
> about 1.2 - 2MB/sec before saturating cpu on the wndr3700v2. (MB
> =megabyte)
>
> I can r/w a usb stick at about 8/7 MB/sec. I haven' tried a 'real'
> hard disk.
>
> About 50Mbit/sec I figure covers the 95 percentile of most home users
> to their ISP. 100Mbit would be better. Being drop-free would be really
> helpful on shorter tests....
>
> I was also thinking about an in-kernel module that uses 'splice' to
> send the data to a file... as well as  the current jit work for bpf,
> using netfilter, and various other alternatives.

There may be faster USB sticks as well.  Certainly, SD cards vary hugely
for write performance, and you can buy way faster ones than the "cheap"
ones you get.

For example:
http://www.amazon.com/Patriot-Xporter-Speed-Flash-PEF32GRUSB/dp/B003WUX6RO/ref=sr_1_1?ie=UTF8&qid=1319043694&sr=8-1
<http://www.amazon.com/Patriot-Xporter-Speed-Flash-PEF32GRUSB/dp/B003WUX6RO/ref=sr_1_1?ie=UTF8&qid=1319043694&sr=8-1>

is much, much faster than most USB sticks (though most HDD's will still
outperform it.
                        - Jim