On Apr 19, 2016, at 10:02 AM, Denis Ovsienko <de...@ovsienko.info> wrote:
> As far as documentation goes, some sense may be presumed in libpcap calling
> posix_fadvise() with POSIX_FADV_SEQUENTIAL. This way the OS would be able to
> adjust the buffers better to read the .pcap file. Does anybody have any
> practical experience with posix_fadvise() to comment if the gain is ever
> visible with present day hardware and OSes?
Annoyingly, on Windows it looks as if the equivalent is to specify
FILE_FLAG_SEQUENTIAL_SCAN at *open* time, in CreateFile():
https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx#caching_behavior
There doesn't appear to be an obvious way of turning that flag on after the
file is opened.
It also appears that if you add the "S" flag to the list of flags in an fopen()
call, you'll get "caching ... optimized for, but not restricted to, sequential
access from disk.", presumably causing FILE_FLAG_SEQUENTIAL_SCAN to be set at
open time, so that would be the equivalent on Windows:
https://msdn.microsoft.com/en-us/library/yeby3zcb(v=vs.71).aspx
We already have to use a different flag to force binary interpretation of the
file, so we might as well add "S" as well.
At some point we should add new APIs for reading capture files that works
better with pcapng (but still supports pcap, so programs don't have to
determine the file type themselves and choose which APIs to use); we should
probably have those files offer random access (with "tell" and "seek"
operations), and a way to indicate whether the file is being opened for
sequential or random access.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers@lists.tcpdump.org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers
