Aggregating many ports into one for tcpdump server.
rwatson at FreeBSD.org
Wed Dec 5 01:50:49 PST 2007
On Wed, 5 Dec 2007, Robert Watson wrote:
> On Wed, 5 Dec 2007, Vlad GALU wrote:
>> I would like to try the aforementioned patches too. Can you please point me
>> to a link?
> You can download our experimental tarball from here:
> You can find a BSDCan quick talk on the topic here:
> I've had several reports of significantly improved packet capture rates at
> high speeds with it, but it's not yet in the tree because we feel it needs
> more evaluation and review. I hope to ship some form of zero-copy BPF
> buffer support in FreeBSD 8, and possibly even MFC it. Any feedback you
> might have would be most helpful.
Having sent you the patch, I should have let you know that you'll need to:
- Add options BPF_ZEROCOPY to your kernel configuration to enable the
zero-copy buffering mode.
- Make sure the kernel and libpcap are rebuild following the application of
the patch and dropping in the tarball.
- setenv BPF_ZERO_COPY before running tcpdump or other BPF-based tools to
enable the zero-copy buffer mode.
The patch includes both kernel changes (abstract the buffer model, add a new
buffer model) and user space changes (updated libpcap to speak the new model,
selected right now with the environmental variable). Presumably if merged,
zero-copy BPF buffers would be used by default via libpcap if present in the
kernel, but right now this is all for evaluation purposes.
Robert N M Watson
University of Cambridge
More information about the freebsd-net