Hi,
I'm trying to figure out why netsniff-ng takes a long time to start up
on one of my machines. I'm running the latest git checkout on Debian
unstable (running the Debian 3.11.6 kernel), and when I run:
netsniff-ng --silent -i eth1 -o /dev/null
I see a delay of about 15 seconds before the "Running! Hang up with ^C!"
message is printed. Looking at netsniff-ng with strace, I see the
following:
[...]
1387508695.193460 setsockopt(3, SOL_PACKET, 0x11 /* PACKET_??? */, [64], 4) = 0
1387508695.193526 setsockopt(3, SOL_PACKET, PACKET_VERSION, [2], 4) = 0
1387508695.193587 getsockopt(3, SOL_PACKET, PACKET_VERSION, [2], [4]) = 0
1387508695.193650 setsockopt(3, SOL_PACKET, PACKET_RX_RING,
"\0\0\1\0\346\16\0\0\0\0\1\0\346\16\0\0d\0\0\0\0\0\0\0\0\0\0\0", 28) = 0
1387508709.738025 mmap(NULL, 249954304, PROT_READ|PROT_WRITE,
MAP_SHARED|MAP_POPULATE|MAP_LOCKED, 3, 0) = 0x7f13cba7e000
1387508709.747174 getsockopt(3, SOL_PACKET, PACKET_VERSION, [2], [4]) = 0
1387508709.747347 bind(3, {sa_family=AF_PACKET, proto=0x03, if3,
pkttype=PACKET_HOST, addr(0)={0, }, 20) = 0
[...]
Note that the PACKET_RX_RING setsockopt() call takes about 15 seconds to
complete. During this time I see the netsniff-ng process consuming
about 90% of a CPU, and according to a "perf record" / "perf report" run
most of the time appears to be spent in these functions in the kernel:
31.29% netsniff-ng [kernel.kallsyms] [k] get_pageblock_flags_group
26.69% netsniff-ng [kernel.kallsyms] [k] isolate_freepages_block
24.22% netsniff-ng [kernel.kallsyms] [k] isolate_migratepages_range
2.41% netsniff-ng [kernel.kallsyms] [k] compaction_alloc
0.99% netsniff-ng [kernel.kallsyms] [k] __wake_up_bit
0.95% netsniff-ng [kernel.kallsyms] [k] __reset_isolation_suitable
0.85% netsniff-ng [kernel.kallsyms] [k] free_pcppages_bulk
0.80% netsniff-ng [kernel.kallsyms] [k] release_pages
0.76% netsniff-ng [kernel.kallsyms] [k] __pagevec_lru_add_fn
0.62% netsniff-ng [kernel.kallsyms] [k] page_waitqueue
0.61% netsniff-ng [kernel.kallsyms] [k] migrate_pages
0.58% netsniff-ng [kernel.kallsyms] [k] move_to_new_page
0.54% netsniff-ng [kernel.kallsyms] [k] mutex_lock
Help? It seems to be related to the size of the RX ring buffer -- if I
specify "-S 1MiB" to netsniff-ng it starts up quickly. But I also have
another machine where netsniff-ng starts up quickly with the default
ring buffer size.
I can send the full strace output and perf.data files if needed.
--
Robert Edmonds
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
