Hi,
The upcoming libpcap 1.5 have support for TPACKET_V3 which seems to
improve on packet drops at high sped captures. However some tests on a 1
Gb link with ~900 Mb/s indicates that tcpdump does better than dumpcap
possibly because dumpcap uses "inpkts = pcap_dispatch(pcap_opts->pcap_h,
1, capture_loop_write_packet_cb, (u_char *)pcap_opts);" fetching
packets one by one rather than using -1.
Any way, any one interesting in looking into making dumpcap more efficient?
Regards
Anders
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
