Date: Sat, 8 Aug 1998 18:09:14 +0200 (CEST) From: Andre Albsmeier <andre.albsmeier@mchp.siemens.de> To: luigi@labinfo.iet.unipi.it (Luigi Rizzo) Cc: andre.albsmeier@mchp.siemens.de, freebsd-net@FreeBSD.ORG, freebsd-questions@FreeBSD.ORG Subject: Re: Does this impose a high load on a system? Message-ID: <199808081609.SAA24892@internal> In-Reply-To: <199808081402.QAA16403@labinfo.iet.unipi.it> from Luigi Rizzo at "Aug 8, 98 04:02:17 pm"
next in thread | previous in thread | raw e-mail | index | archive | help
> > Hello, > > > > I am running a nice little program named arpwatch. It collects > > information about new machines being attached to a network. > > I do this because I can monitor if someone links a new > > machine to our nets. > > > > For this operation, the network interface is put into promiscuous mode. > > IIRC, this means that all packets are passed to the kernel and maybe > > even all to the running program (arpwatch). I wonder if this causes > > a high load on the machine since I think it might have to process > > it depends on how much data it copies from the packet up to user space. > To see if there is really a performance problem you should probably try > to flood the local network segment with a separate machine and see how > much load this causes. Just have done that and noticed nothing. The program uses bpf and the line which configures it is here: if (pcap_compile(pd, &code, "arp or rarp", 1, netmask) < 0) So I assume that all packets that are no (r)arp packtes are already rejected in the kernel and this is why I don't see anything. > > If you are concerned about performance maybe you can hack the network > driver to grab the info you need, store in a table, and access them via > some separate interface. > > (i am thinking of a similar approach in an attempt to implement bridging > in freebsd). > > cheers > luigi That might be the best idea but at the moment I have a lack of time for doing this. (And the moment seems to last forever :-)) Thanks, -Andre To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?199808081609.SAA24892>