On Aug 22, 2015, at 12:48 PM, barcaroller <barcarol...@gmail.com> wrote:
> I've been running performance tests against pcap_next_ex() and pcap_dump(). > I've placed micro-second timers around both functions So those are presumably real-time timers rather than CPU timers. > and sent millions of packets to my test programs. > > Both functions performed admirably over a short period of time (up to 8 > Gbits/sec) but, as time progressed, both functions became increasingly slower > until the data rate dropped to 200 Mbits/sec. How short is "short"? Tens of seconds? Minutes? > Please note that the two functions become slower even when I read/wrote new > pcap files (i.e. I would close a pcap file and start reading/writing a new > PCAP file, but the performance still remained low). What happens if you have a test program that doesn't write the packets out? > Does anyone know how to explain this? Not without at least knowing on what OS you're doing this. Those routines make system calls, so there might be a *kernel* resource involved. _______________________________________________ tcpdump-workers mailing list tcpdump-workers@lists.tcpdump.org https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
