Zero-Copy for packet capture and mbuf question

[Julian Elischer]

On 9/14/11 6:35 PM, Jon Schipp wrote:
> Has anyone used the zero-copy mechanism for an increased performance in
> packet capturing?
> I'm on FreeBSD 8.2-RELEASE, I was thinking about trying it. It's for a
> network monitoring system, it just grabs and dumps all data
> from all my network segments. I've noticed improvements by increasing the
> bpf buf size and maxbufsize which in turned increased the
> initial buffer size for libpcap. I'm dropping less now.
>
> In 8.2, is turning on zero-copy as simple as changing the value of
> net.bpf.zerocopy_enable?
> http://node5.blogspot.com/2009/11/very-quick-look-at-zero-copy-bpf-in.html
> I can't seem to find much information that shows that it's this simple.
> Right now it seems that if I want to use zero-copy for sends
> I would have to recompile the kernel with: options ZERO_COPY_SOCKETS
> But for receives, which is only what I'm concerned about, it seems that I
> just turn it on via sysctl.
>
> *I see that in 9.0 it will be on by default*
>
> Another question: I'm assuming all packets get copied to an mbuf from the
> NIC and then copied again to the bpf device/bpf buffer. Can anyone verify
> this?
> I don't think raising my mbufs will help, since a few hundred are free
> during peak hours. Will increasing the amount of mbuf clusters (nmbclusters)
> only help when you are pushing the threshold i.e. running out? Also, out of
> curiousity, is it possible to increase the amount of mbufs as opposed to the
> amount of mbuf clusters?

if you really want high performance packet capture and you are running one
of the supported cards, see Luigi's work at:

     http://info.iet.unipi.it/~luigi/netmap/


> Any help is appreciated.
> Thanks