Aggregating many ports into one for tcpdump server.

[Vlad GALU]

On 12/5/07, Robert Watson <rwatson at freebsd.org> wrote:
>
> On Wed, 5 Dec 2007, Robert Watson wrote:
>
> > On Wed, 5 Dec 2007, Vlad GALU wrote:
> >
> >> I would like to try the aforementioned patches too. Can you please point me
> >> to a link?
> >
> > You can download our experimental tarball from here:
> >
> > http://www.watson.org/~robert/freebsd/20071103-zcopybpf.tgz
> >
> > You can find a BSDCan quick talk on the topic here:
> >
> > http://www.watson.org/~robert/freebsd/2007bsdcan/20070517-devsummit-zerocopybpf.pdf
> >
> > I've had several reports of significantly improved packet capture rates at
> > high speeds with it, but it's not yet in the tree because we feel it needs
> > more evaluation and review.  I hope to ship some form of zero-copy BPF
> > buffer support in FreeBSD 8, and possibly even MFC it.  Any feedback you
> > might have would be most helpful.
>
> Having sent you the patch, I should have let you know that you'll need to:
>
> - Add options BPF_ZEROCOPY to your kernel configuration to enable the
>   zero-copy buffering mode.
>
> - Make sure the kernel and libpcap are rebuild following the application of
>   the patch and dropping in the tarball.
>
> - setenv BPF_ZERO_COPY before running tcpdump or other BPF-based tools to
>   enable the zero-copy buffer mode.
>
> The patch includes both kernel changes (abstract the buffer model, add a new
> buffer model) and user space changes (updated libpcap to speak the new model,
> selected right now with the environmental variable).  Presumably if merged,
> zero-copy BPF buffers would be used by default via libpcap if present in the
> kernel, but right now this is all for evaluation purposes.

   Thanks, Robert! I'll start running a few tests next week, I'm
waiting for some hardware to arrive first.

>
> Robert N M Watson
> Computer Laboratory
> University of Cambridge
>


-- 
Mahnahmahnah!