On Fri, 21 Mar 2014, Steinar H. Gunderson wrote:
On Fri, Mar 21, 2014 at 03:39:16PM +0000, Dave Taht wrote:
Is your hardware fast enough to run tcpdump -s 128 -w whatever.cap -i
your interface during an entire rrul test without dropping packets?
(on client and server)
(question to list) Are there any options to tcpdump or the kernel to
make it more possible to capture full packet payloads (64k) without
loss at these speeds? tshark?
You can capture tens of gigabits of traffic if you use the mmap packet ring
stuff. Doubt tcpdump supports it, but it wouldn't be impossible to do.
I'm a bit confused if a normal machine these days can't easily saturate
gigabit (and capture it to SSD without further problems), though.
I've been able to capture gigabit traffic with fairly normal CPUs (<3GHz), the
key I found was to bypass all tcpdump processing at capture time, just write the
raw packets out. I had a disk array on a medium quality FC card for this, but
did the same thing with a 3ware 955x RAID card and a handful of SATA drives.
David Lang
_______________________________________________
Bloat mailing list
[email protected]
https://lists.bufferbloat.net/listinfo/bloat
