libpcap perf improvement? latest ideas?

[Sam Leffler]

Robert Watson wrote:
> On Thu, 5 Oct 2006, Jochen Kaiser wrote:
> 
>> after reading a german master thesis [1] (dated 12/2004) about pcap
>> performance (with comparison of linux and freebsd) I searched freebsd
>> resources for pcap improvements. Unofortunately I did not find any
>> improvements like PF_RING and/or efforts for reducing the number of
>> copy operations from device to user space.
>>
>> Maybe I think too simple because I don't know how SMP fine locks are
>> influencing this (maybe it is very complex to improve that when you
>> want to avoid side effects.).
>>
>> Or maybe it is not important at all, because real applications use DAG
>> boards?
>>
>> I would appreciate any discussion here.
>>
>> greetings,
>> Jochen
>>
>> [1] www.net.in.tum.de/teaching/projects/docs/schneider_SEP_slides2.ps
>> [2] www.endace.com
> 
> Quite a bit of work has been done on zero-copy for BPF, but none of it
> really commitable.  Christian Peron (CC'd) and I have been talking about
> doing something that is commitable, but some of the details (such as
> memory ownership) are still very much up in the air.  PF_RING takes an
> interesting approach, and one we should look at, but we'd also like to
> keep all the benefits of BPF rather than discard them, so need to
> consider how best to apply elements of the approach in our context.  I'd
> like to see something like this happen for FreeBSD 7.0, with a possible
> backport if it goes really well. :-)

Note that bpf on bsd has historically had significantly better capture
performance than equivalent linux facilities.  Many people using freebsd
have been misled by the default setting of the kernel buffers which are
intentionally low:

tubby% sysctl net.bpf
net.bpf.bufsize: 4096
net.bpf.maxbufsize: 524288

If you up net.bpf.bufsize you can reliably capture most traffic w/ a
reasonable nic.  OTOH the current bpf code does have excessive locking
overhead that could be improved and using alternate schemes that do
zero-copy are required for 10g nets.

	Sam