Re: libpcap buffering...

[Guy Harris <guy () alum mit edu>]

On Mar 30, 2014, at 7:01 AM, barcaroller <barcaroller () gmail com> wrote:

> I have two questions related to buffers in libpcap.
>
> - I would like to to use the pcap_set_buffer_size() to run various performance tests.  However, I do not know the 
> default buffer size (on a 64-bit Linux system with 16 GB of RAM) and I do not know how to get it (there is no 
> pcap_get_buffer_size()).  How can I tell what the existing buffer size is before I start changing that value?

You'd have to modify libpcap to provide that information.

> - I would like to improve the performance of pcap_dump() when writing packets to disk.  I know that pcap_dump() 
> already uses some kind of buffering.

The only buffering it uses is the buffer provided by the "standard I/O library" routines (fopen(), fwrite(), fclose()) 
that it uses to open the dump file, write to it, and close it.

> What is the best way to approach this?  Can the aforementioned function (pcap_set_buffer_size()) be used for this 
> purpose,

No.  The standard I/O buffer is completely separate for the packet capture buffering.

_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers