Having a separate write-only thread could even help the performance if done right. This will raise the complexity of netsniff-ng code a LOT, though.
We could go from here to multiple write processes to better use modern storage subsystems. In fact here we go back to multiple independent processes because you might want to have two writer processes that save packets to two independent RAID groups. This should be better than one giant group. And we're back to square one ;-) So far Daniel's idea seems to be best to take, at least for the start. On Thu, Apr 30, 2015 at 6:29 PM, Daniel Borkmann <[email protected]> wrote: > Hi Vadim, > > On 04/30/2015 05:58 PM, Vadim Kochan wrote: >> >> On Thu, Apr 30, 2015 at 05:42:41PM +0200, Daniel Borkmann wrote: > > ... >>>> >>>> sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type >>>> hash --mmap --ring-size 256MiB --bind-cpu 18 --silent --in eth5 --out >>>> /mnt/sdb1/netcapture/ --prefix "eth5." --interval 60sec & >>>> sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type >>>> hash --mmap --ring-size 256MiB --bind-cpu 20 --silent --in eth5 --out >>>> /mnt/sdb1/netcapture/ --prefix "eth5." --interval 60sec & >>>> sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type >>>> hash --mmap --ring-size 256MiB --bind-cpu 22 --silent --in eth5 --out >>>> /mnt/sdb1/netcapture/ --prefix "eth5." --interval 60sec & >>>> > ... >> >> What about if netsniff-ng can fork children so each children will use >> separate output file in specified directory and at the end after all >> children done then the main netsniff-ng will merge these files into one, >> and >> remove the files which were generated by children... >> >> Just thoughts ... > > > I am not opposed to this idea, I think it would be nice, (but!) only > if it's done right. What I'm a bit concerned is the rising complexity > for such a command line configuration. > > That makes me wondering if perhaps a flex/bison possibility should be > designed for netsniff-ng, which can parse a config file, run in daemon > mode and spawn such sub-processes. > > Maybe like: netsniff-ng < config > > > -- > You received this message because you are subscribed to the Google Groups > "netsniff-ng" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
