Zero-Copy for packet capture and mbuf question

[Jon Schipp]

Has anyone used the zero-copy mechanism for an increased performance in
packet capturing?
I'm on FreeBSD 8.2-RELEASE, I was thinking about trying it. It's for a
network monitoring system, it just grabs and dumps all data
from all my network segments. I've noticed improvements by increasing the
bpf buf size and maxbufsize which in turned increased the
initial buffer size for libpcap. I'm dropping less now.

In 8.2, is turning on zero-copy as simple as changing the value of
net.bpf.zerocopy_enable?
http://node5.blogspot.com/2009/11/very-quick-look-at-zero-copy-bpf-in.html
I can't seem to find much information that shows that it's this simple.
Right now it seems that if I want to use zero-copy for sends
I would have to recompile the kernel with: options ZERO_COPY_SOCKETS
But for receives, which is only what I'm concerned about, it seems that I
just turn it on via sysctl.

*I see that in 9.0 it will be on by default*

Another question: I'm assuming all packets get copied to an mbuf from the
NIC and then copied again to the bpf device/bpf buffer. Can anyone verify
this?
I don't think raising my mbufs will help, since a few hundred are free
during peak hours. Will increasing the amount of mbuf clusters (nmbclusters)
only help when you are pushing the threshold i.e. running out? Also, out of
curiousity, is it possible to increase the amount of mbufs as opposed to the
amount of mbuf clusters?

Any help is appreciated.
Thanks
-- 
- Jon
-- 
------------------------------------------------------------------

VMB: 812-682-0231

Dubois County Linux User Group - http://www.dclinux.org
Southern Indiana Computer Klub - http://sickbits.networklabs.org
Bloomington FOOLS - http://www.bloomingtonfools.org/
BloomingLabs -  http://www.bloominglabs.org
ISSA-Kentuckiana  -  http://issa-kentuckiana.org

GPG Key ID: 810903CB
Key fingerprint = 0069 ED69 EABB DF84 5983  AD3C 6C20 BEFD 8109 03CB