On 04/30/2015 08:19 PM, [email protected] wrote: ...
Would this be possible but by keeping files in RAM rather than in directory before main netsniff-ng would merge them into single final file ?
If you mean "files" in the sense of files that should be open(2)'ed etc, then you need an underlying file system which does management for you. And that can be something like tmpfs et al which is entirely in ram. If you mean, to accumulate data by all instances in a huge, shared buffer, then I'm not yet seeing it how it should scale. You will certainly need in addition atomic operations to make sure buffer slots will not get corrupted, and we should avoid such contention, plus you have to get that to disc at some point. Lets say, each process would have it's own buffer it operates on for each single core, and there's one core dedicated to collect from all buffers, and write them to disc. That would require substantial changes in how netsniff-ng operates, but currently, you could spread that load to various discs and not a single one, arguably with the mentioned drawback that you need to merge pcaps if you prefer one big one. But even for that you could dedicate a single core and get a cronjob running that merges them and moves the data out of ram. I think that the interval such a merged pcap covers might usually not that huge anyway to keep it manageable.
Alternative could be me creating RAM disk for temp files. I guess that should work too although it adds complexity of separate scripts I
> would have to run to merge files into one main 1-minute capture file. Yep, that would require a bit of scripting, but it shouldn't be difficult. Why not implementing a generic script, that we could merge upstream as an example use case? That way, it gives a good starting point for you and others? ;) -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
