Hi Daniel, Vadim, thanks for your suggestions !
Regarding : > > You also wouldn't want to do that. ;) Because assume if such a possibility > > would exist, then the bottleneck becomes easily the write to disc on that > > single file. You rather want to have parallelism all the way to the > > hardware in the best case. If you need to merge file, there could f.e. be a > > background process grabbing individual pcap files and merge them based on > > the time-stamps into a single one, e.g. mergecap: I suggested that approach based on SolarCapture which was available by SolarFlare for their cards. They have 1 solar_capture process where you define multiple capture cores and one writeout core. Not sure if anyone used SolarFlare SFN5122/7122 cards. They used to offer free solar_capture tool for near loss-less capture. The issue of bottleneck on write to HD should be reduced by using SSD. We use SSD and lots of RAM. The ultimate scenario for lossless capture I was suggested by SolarFlare is something like : 6 Rx queues for NIC and 6 capture cores and 1 writeout core for solar_capture, all on same physical CPU. Not sure how they did it and why did they suggest this approach, but their tool doesn't start multiple solar_capture processes, but shows one process using 300% of CPU if you use 3 capture cores for example. Regarding : > What about if netsniff-ng can fork children so each children will use > separate output file in specified directory and at the end after all > children done then the main netsniff-ng will merge these files into one, and > remove the files which were generated by children... this would be also possible, but I am afraid mergecap might cause bottleneck on I/O because we need to constantly write new files while trying to merge files generated by children. 1-minute files are 1-2GB and we have to capture 24/7. That's why I was hoping netsniff-ng could put that into one output file to avoid post-processing of captured data. Regards Ivan -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
