Re: pcap_next_ex() and pcap_dump() performance decreases over time...

[Guy Harris <guy () alum mit edu>]

On Aug 22, 2015, at 8:06 PM, barcaroller <barcaroller () gmail com> wrote:

> It has puzzled me too.  Keep in mind that I am making millions of these pcap calls; only one of them could be taking 
> 2 seconds.

Then the average might be more interesting than the maximum.

> I actually read the packets from a pcap file (not part of the test), store the packets in memory (e.g. 50,000 
> packets), then write them in a loop to disk (e.g. 50,000 x 1,000) using multiple pcap files (none greater than 
> 100MB); this is phase 1.

So does "50,000 x 1,000" mean that it writes out each packet 1,000 times?

So the reading of the file in phase 1 isn't being tested, so the pcap_next_ex() calls being performance-tested are in 
phase 2?

>  I then read all packets (e.g. 50,000 x 1,000) in chunks and destroy each chunk before reading the next; this is 
> phase 2.

"In chunks" meaning that you have a loop that reads a chunk worth of packets, with each packet read with 
pcap_next_ex(), and then free all the packets in the chunk before reading the next chunk?

> Right.  But something in the process is making pcap_next_ex() and pcap_dump() slower with time.

Something *somewhere* is.
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers