pcap performance question

[Andreas Rieke <andreas.rieke () isl de>]

Hi,

I have a question concerning the performance and stability of libpcap.

I would like to capture TCP traffic to/from several groups of hosts, 
maybe we are talking about 20-30 groups in the maximum with something 
between 1-10 hosts in each group. All these host have individual IPs and 
ports, there is no chance to capture parts of a network or something 
like that. I would like to do the job with libpcap under linux and 
winpcap under windows.

The first approach is to apply pcap with one thread and a huge filter 
expression, where pcap filters the interesting traffic and my 
application just has to find out to which group of hosts a packet 
belongs. The second approach is to start an own thread for each group, 
where the filter expression should be quite simple. In the second 
approach, pcap would do the whole filtering job, so that my application 
would not cause too much CPU load.

If you had to solve this problem, which way would you go?
- Are there any restrictions concerning the filter expression (length, 
complexity)?
- Which approach is the more stable one?
- Which approach is the more performant one?

Thanks in advance,

Andreas








--
Dr. Andreas Rieke
Geschäftsführer
ISL Internet Sicherheitslösungen GmbH
Bergstrasse 128, 58095 Hagen
Amtsgericht Hagen HRB 3816

-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.