Re: [tcpdump-workers] Performance impact with multiple pcap handlers on Linux

2020-12-22 Thread Guy Harris via tcpdump-workers
--- Begin Message --- On Dec 22, 2020, at 3:31 PM, Linus Lüssing wrote: > Basically we want to do live measurements of the overhead of the mesh > routing protocol and measure and dissect the layer 2 broadcast traffic. > To measure how much ARP, DHCP, ICMPv6 NS/NA/RS/RA, MDNS, LLDP overhead > etc.

Re: [tcpdump-workers] Performance impact with multiple pcap handlers on Linux

2020-12-22 Thread Linus Lüssing via tcpdump-workers
--- Begin Message --- On Tue, Dec 22, 2020 at 02:28:17PM -0800, Guy Harris wrote: > On Dec 22, 2020, at 2:05 PM, Linus Lüssing via tcpdump-workers > wrote: > > > I was experimenting a bit with migrating from the use of > > pcap_offline_filter() to pcap_setfilter(). > > > > I was a bit surprised

Re: [tcpdump-workers] Performance impact with multiple pcap handlers on Linux

2020-12-22 Thread Guy Harris via tcpdump-workers
--- Begin Message --- On Dec 22, 2020, at 2:05 PM, Linus Lüssing via tcpdump-workers wrote: > I was experimenting a bit with migrating from the use of > pcap_offline_filter() to pcap_setfilter(). > > I was a bit surprised that installing for instance 500 pcap > handlers What is a "pcap handler

[tcpdump-workers] Performance impact with multiple pcap handlers on Linux

2020-12-22 Thread Linus Lüssing via tcpdump-workers
--- Begin Message --- Hi, I was experimenting a bit with migrating from the use of pcap_offline_filter() to pcap_setfilter(). I was a bit surprised that installing for instance 500 pcap handlers with a BPF rule "arp" via pcap_setfilter() reduced the TCP performance of iperf3 over veth interfaces

Re: [tcpdump-workers] [OPSAWG] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- IANA considerations

2020-12-22 Thread Guy Harris via tcpdump-workers
--- Begin Message --- On Dec 22, 2020, at 8:36 AM, Michael Richardson wrote: > Guy Harris wrote: > >> And, as per my idea of using 65535 to mean "custom linktype", similar >> to pcapng custom blocks and options, with either: > > I'm happy with this proposal, but isn't it pcapng specific? No -

Re: [tcpdump-workers] [OPSAWG] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- IANA considerations

2020-12-22 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- wrote: >> -Message d'origine- >> De : OPSAWG [mailto:opsawg-boun...@ietf.org] De la part de Michael >> Richardson >> Envoyé : mardi 22 décembre 2020 17:36 >> À : Guy Harris >> Cc : Pcap-ng file format ; >> ops...@ietf.org; tcpdump-workers

Re: [tcpdump-workers] [OPSAWG] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- FCS length description

2020-12-22 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- <#secure method=pgp mode=sign> Guy Harris wrote: > a 6-bit "extension" field, storing information about the > capture, such an indication of whether the packets include an > FCS and, if so, how many bytes of FCS are present. > So what NetBSD had was a conve

Re: [tcpdump-workers] [OPSAWG] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- IANA considerations

2020-12-22 Thread Michael Richardson via tcpdump-workers
--- Begin Message --- <#secure method=pgp mode=sign> Guy Harris wrote: >> The short of it is: >> >> 1) reserve bits 16:28 of linktype as zero. > In pcap files, presumably; you have only bits 0:15 in pcapng IDBs. Yes. That's why I changed the illustration of the packet so that

Re: [tcpdump-workers] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- FCS length description

2020-12-22 Thread Guy Harris via tcpdump-workers
--- Begin Message --- On Dec 22, 2020, at 1:01 AM, Guy Harris wrote: > They were originally intended for use with some stuff NetBSD was doing (I'd > have to look into the history of the NetBSD code), but I think NetBSD stopped > doing that. The commit message for the change that added the macr

Re: [tcpdump-workers] [pcap-ng-format] draft-gharris-opsawg-pcap.txt --- FCS length description

2020-12-22 Thread Guy Harris via tcpdump-workers
--- Begin Message --- On Dec 21, 2020, at 4:31 PM, Michael Richardson wrote: > Hi, I have reworked the document that Guy put into XML describing the *PCAP* > (not NG) format. I found the text for LinkType to be confusing, and > frankly, I think wrong. > > * LinkType (32 bits): an unsigned v