Subject: Re: bpf/pcap performance
To: Michael Richardson <mcr@sandelman.ottawa.on.ca>
From: Darren Reed <darrenr@reed.wattle.id.au>
List: tech-net
Date: 04/08/2004 17:35:56
In some email I received from Michael Richardson, sie wrote:
-- Start of PGP signed section.
>
> >>>>> "Darren" == Darren Reed <darrenr@reed.wattle.id.au> writes:
> Darren> In testing on identical hardware, using an identical test
> Darren> suite, I've observed 100% packet capture with freebsd 5.1
> Darren> but netbsd 1.6zk always returned some packet loss (in this
> Darren> instance, missing 1 packet is as bad as missing 10 or 100 or
> Darren> 1000.) On this particular piece of hardware, freebsd 5.1 is
> Darren> returning 100% captures at upto 150Mb/s spread over 4 NICs
> Darren> (2*Intel Pro100S, 2*Intel 1000MT.)
>
> A question - when you say 100% packet capture, you mean that you
> caught as many packets as you sent?
Yes, that we capture as many as we send.
> I'm asking if it is that NetBSD is loosing packets, or that FreeBSD is
> failing to report them as lost.
The packet counting is done on what's returned in BPF buffers, the "lost
packet count" is ignored.
To answer some other questions,
* both FreeBSD 5.1 & NetBSD 1.6ZK have 1MB maximum BPF buffer sizes in
the kernel.
* GENERIC kernels are being used - no modifications, no sysctl tuning.
* libpcap-2004-something is being used with pcap_setbuff to set the BPF
buffer to 1MB
* The drivers are fxp (intel pro 100s), em (FreeBSD 1000MT) &
wm (NetBSD 1000MT).
The packet loss in NetBSD occurs even if it is just single NIC to NIC,
at which the test driver (linux) tops out at 84Mb/s.
Darren