[prev in list] [next in list] [prev in thread] [next in thread] 

List:       ntop-dev
Subject:    RE: [Ntop-dev] libpcap performance
From:       "Burton M. Strauss III" <Burton () ntopsupport ! com>
Date:       2003-08-27 20:21:36
Message-ID: JIEPJGFPFMFIGBNCPKGGCEFPEEAA.Burton () ntopsupport ! com
[Download RAW message or body]

Luca...

There's a lot of stuff written about packet loss, but nothing I could find
that was definitive.

I've written on it too, search for 'Zero Copy' in the FAQ (it's got pointers
to the articles).

Also threads like this:

http://archives.neohapsis.com/archives/snort/2001-04/0183.html -- which
indicate that the Linux pcap_stats counters are bogus.

And this :-) http://www.ist-scampi.org/events/bof-2003/deri.pdf

Might try talking to these folks (see 3.5)
http://traffic.caida.org/CoralReef/coral-3.5.1-public/doc/coralreef-faq-3.ht
ml, it sounds like they have experience with the limits of libpcap.


-----Burton



-----Original Message-----
From: ntop-dev-admin@unipi.it [mailto:ntop-dev-admin@unipi.it]On Behalf
Of Luca Deri
Sent: Monday, August 18, 2003 4:01 AM
To: ntop-dev
Cc: Vicki Vinci
Subject: [Ntop-dev] libpcap performance


Dear all,
I have an Athlon 1.6 Ghz, RH Linux 8, connected with a X-cable to a
Juniper (I have a similar setup with a Cisco Catalyst). The Juniper
sends packets to ntop (it mirrors the backbone that runs at 100 Mbit
with average load of 80 Mbit). What I have noticed is that
ntop/tcpdump/... anything that sits on pcap looses a small packet
percentage although there are plenty of CPU cycles. Is there a way to
tune libpcap so that I can prevent/minimize packet loss?

Thanks, Luca

--
Luca Deri <deri@ntop.org>	http://luca.ntop.org/
Hacker: someone who loves to program and enjoys being
clever about it - Richard Stallman


_______________________________________________
Ntop-dev mailing list
Ntop-dev@unipi.it
http://listgateway.unipi.it/mailman/listinfo/ntop-dev


[prev in list] [next in list] [prev in thread] [next in thread]