On 03/04/2013 07:26 PM, [email protected] wrote:
What you could do is the following: 1) Run netsniff-ng with pcap output to stdout: netsniff-ng -i eth0 -o - -b 0 | your_tool 2) netsniff-ng will stdout in pcap file format, so you need to have a look if there are some java libs that can read this format. Instead of opening a pcap file in your program, you would then read an infinite stream from stdin.1) Will this bypass the packet Dissector?
Yes. Because no possible dissector will cope with 5 Mio pps. Your console is just too slow for this.
2) will it be Zero-copy mode
Yes. By zero-copy is always meant that it will not copy packets from the kernel address space to the user address space in the initial receive path.
3) Will I be able to handle 5 M pps?
This all depends on your hardware, OS settings, OS/HW tuning etc. A simple answer like "yes" or "no" is impossible to give. -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/groups/opt_out.
