[Bloat] AQM creeping into L2 equipment

[David Lang]

On Fri, 21 Mar 2014, Steinar H. Gunderson wrote:

> On Fri, Mar 21, 2014 at 03:39:16PM +0000, Dave Taht wrote:
>>>> Is your hardware fast enough to run tcpdump -s 128 -w whatever.cap -i
>>>> your interface during an entire rrul test without dropping packets?
>>>> (on client and server)
>> (question to list) Are there any options to tcpdump or the kernel to
>> make it more possible to capture full packet payloads (64k) without
>> loss at these speeds? tshark?
>
> You can capture tens of gigabits of traffic if you use the mmap packet ring
> stuff. Doubt tcpdump supports it, but it wouldn't be impossible to do.
>
> I'm a bit confused if a normal machine these days can't easily saturate
> gigabit (and capture it to SSD without further problems), though.

I've been able to capture gigabit traffic with fairly normal CPUs (<3GHz), the 
key I found was to bypass all tcpdump processing at capture time, just write the 
raw packets out. I had a disk array on a medium quality FC card for this, but 
did the same thing with a 3ware 955x RAID card and a handful of SATA drives.

David Lang