Hi!
Im trying to get an idea of the performance of the pcap_nect_ex function in
a linux environment (ubuntu 14.04)
I just have a loop where I call pcap_next_ex continuoslly for a certain
time.
The handle has been configured like this (all the return checks removed from
this post)
char errbuf[100];
int bufferSize = BUFSIZ;
pcap_t *header = pcap_create(devs, errbuf);
pcap_set_snaplen(header, bufferSize);
pcap_set_promisc(header, 1);
pcap_set_timeout(header, -1); //NO timeout
pcap_set_tstamp_type(header, PCAP_TSTAMP_ADAPTER);
pcap_set_immediate_mode(header,1); /IMMEDIATE MODE!!!
pcap_activate(header);
I tested in a network where I have only regular traffic (ARP, MDNS,
) and
the packages are small (max length is 317 bytes!)
To have an idea of the load in the network:
50 packages in 20 secs!!!!
Using this loop:
while(1)
{
gettimeofday (&tvalBefore, NULL);
int status = pcap_next_ex(handle,&header, (const u_char **)&packet);
gettimeofday (&tvalAfter, NULL);
if(status == 1)
{
LOG the delta time
}
};
I get that the time required by pcap_next_ex to return a package can be
between 100us to more than 20 ms!!!!!
I tested with several different versions of pcap (1.4.0, 1.5.3 and the
latest 1.7.4) with the same result!
What is the explanation for this HUGE time range?
I believe that Im missing something very basic to get the package capturing
a lot faster but have no idea
..
Any help to understand this behaviour will be really appreciated because Im
out of ideas to test!!
Regards
Tescik Ramos Aladro
Senior Software Architect
FMTP Power AB
Alströmerv. 23, 19144,SOLLENTUNA, SWEDEN
* +46708746885
7 +46859084778
* <mailto:tescik.ala...@fmtppower.com> tescik.ala...@fmtppower.com
<http://www.fmtppower.com/> www.fmtppower.com
FMTP From Minus To Plus
Engineering solutions and Consulting for the global Power Industry and other
Industries.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
