Hi Fulvio, > > What have you found that makes you say this ? > > The simplicity in cpu cycle cost ? > > 1. simplicity > 2. swappable buffers are very helpful if you plan to make statistics, not > only packet capture. > For instance, let's think about a system (like a NetFlow probe or something > like that) that collects statistics, then it returns data to the user every > N minutes. If you have two buffers you can put statistics in the first one, > while you can read data from the second one, and swap buffers every N > minutes. > If you have a ring buffer and your application wants to read data, you have > to stop collecting stats, lock the ring, copy its content in another buffer, > unlock the ring, read data from the second buffer, and restart computing > statistics.
Is it really that hard with a ring ? At least on Unix I think the way to go would be to just make sure that the input side of the ring processing (transferring packets from NICs) was not able to overtake the reading by the user process. Then, with successive calls to uiomove(), data is copied from the ring out to the user process. That is if the number of buffers in the ring is static. Or did you try doing this with Windows and found other problems? Like the copy to user space is so expensive that it is quicker to copy into a new kernel buffer, unlock the ring, and then copy to userspace? btw, do you have any comments on how stable WinPCap2p3 is/was? We had some systems running this but found Windows 2000 to be extremely unreliable (systems would lockup and require a hard reset at least once every 2 weeks.) Darren - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
