On Thu, Dec 07, 2000 at 11:39:58PM -0800, Guy Harris wrote:
> Or, as per my other mail, perhaps using, on Windows, a version of the
> standard I/O library that does bigger writes, hence fewer system calls.
Nope. According to "strace for NT":
http://www.securiteam.com/tools/Strace_for_NT_-_low_level_system_calls_tracer.html
and the Windows(R) NT(R)/2000 Native API Reference:
http://www.newriders.com/books/title.cfm?isbn=1578701996
it's doing 4K writes in the underlying NT system call "NtWriteFile()".
I suspect that running the test on FreeBSD 4.x and tweaking libpcap to
use a 512KB buffer might make a big difference here.
At this point, we might want to limit followups to one or more of:
[EMAIL PROTECTED] - for discussing changes to libpcap
to allow the buffer size to be set from an application and/or
changing the size it initially tries on BSD (the current version
in CVS starts at 32768 and keeps dividing that in half until it
finds something that works);
[EMAIL PROTECTED], [EMAIL PROTECTED] - for discussing
changes to allow the buffer size to be changes with BIOCSBLEN
even if the BPF device is attached to an interface.
(Both FreeBSD and OpenBSD have the maximum buffer size for BPF as 512KB
in the top of the CVS tree; NetBSD still has it as 32K.)
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
