From owner-freebsd-questions  Sat Aug  8 09:09:43 1998
Return-Path: <owner-freebsd-questions@FreeBSD.ORG>
Received: (from majordom@localhost)
          by hub.freebsd.org (8.8.8/8.8.8) id JAA26478
          for freebsd-questions-outgoing; Sat, 8 Aug 1998 09:09:43 -0700 (PDT)
          (envelope-from owner-freebsd-questions@FreeBSD.ORG)
Received: from david.siemens.de (david.siemens.de [192.35.17.14])
          by hub.freebsd.org (8.8.8/8.8.8) with ESMTP id JAA26458
          for <freebsd-questions@FreeBSD.ORG>; Sat, 8 Aug 1998 09:09:39 -0700 (PDT)
          (envelope-from andre.albsmeier@mchp.siemens.de)
X-Envelope-Sender-Is: andre.albsmeier@mchp.siemens.de (at relayer david.siemens.de)
Received: from mail.siemens.de (salomon.siemens.de [139.23.33.13])
	by david.siemens.de (8.9.1/8.9.1) with ESMTP id SAA07234
	for <freebsd-questions@FreeBSD.ORG>; Sat, 8 Aug 1998 18:09:14 +0200 (MET DST)
Received: from curry.mchp.siemens.de (daemon@curry.mchp.siemens.de [146.180.31.23])
	by mail.siemens.de (8.9.1/8.9.1) with ESMTP id SAA28418
	for <freebsd-questions@FreeBSD.ORG>; Sat, 8 Aug 1998 18:09:15 +0200 (MET DST)
Received: (from daemon@localhost)
	by curry.mchp.siemens.de (8.8.8/8.8.8) id SAA22839
	for <freebsd-questions@FreeBSD.ORG>; Sat, 8 Aug 1998 18:09:16 +0200 (CEST)
From: Andre Albsmeier <andre.albsmeier@mchp.siemens.de>
Message-Id: <199808081609.SAA24892@internal>
Subject: Re: Does this impose a high load on a system?
In-Reply-To: <199808081402.QAA16403@labinfo.iet.unipi.it> from Luigi Rizzo at "Aug 8, 98 04:02:17 pm"
To: luigi@labinfo.iet.unipi.it (Luigi Rizzo)
Date: Sat, 8 Aug 1998 18:09:14 +0200 (CEST)
Cc: andre.albsmeier@mchp.siemens.de, freebsd-net@FreeBSD.ORG,
        freebsd-questions@FreeBSD.ORG
X-Mailer: ELM [version 2.4ME+ PL40 (25)]
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG

> > Hello,
> > 
> > I am running a nice little program named arpwatch. It collects
> > information about new machines being attached to a network.
> > I do this because I can monitor if someone links a new
> > machine to our nets.
> > 
> > For this operation, the network interface is put into promiscuous mode.
> > IIRC, this means that all packets are passed to the kernel and maybe
> > even all to the running program (arpwatch). I wonder if this causes
> > a high load on the machine since I think it might have to process
> 
> it depends on how much data it copies from the packet up to user space.
> To see if there is really a performance problem you should probably try
> to flood the local network segment with a separate machine and see how
> much load this causes.

Just have done that and noticed nothing. The program uses bpf and
the line which configures it is here:

	if (pcap_compile(pd, &code, "arp or rarp", 1, netmask) < 0)

So I assume that all packets that are no (r)arp packtes are already
rejected in the kernel and this is why I don't see anything.

> 
> If you are concerned about performance maybe you can hack the network
> driver to grab the info you need, store in a table, and access them via
> some separate interface.
> 
> (i am thinking of a similar approach in an attempt to implement bridging
> in freebsd).
>
> 	cheers
> 	luigi

That might be the best idea but at the moment I have a lack of time
for doing this. (And the moment seems to last forever :-))

Thanks,

	-Andre

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message