From owner-freebsd-net@FreeBSD.ORG Wed Dec 5 09:43:07 2007 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 047AA16A418 for ; Wed, 5 Dec 2007 09:43:07 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from cyrus.watson.org (cyrus.watson.org [209.31.154.42]) by mx1.freebsd.org (Postfix) with ESMTP id CC9D013C457 for ; Wed, 5 Dec 2007 09:43:06 +0000 (UTC) (envelope-from rwatson@FreeBSD.org) Received: from fledge.watson.org (fledge.watson.org [209.31.154.41]) by cyrus.watson.org (Postfix) with ESMTP id 19DB3471A0; Wed, 5 Dec 2007 04:48:03 -0500 (EST) Date: Wed, 5 Dec 2007 09:42:57 +0000 (GMT) From: Robert Watson X-X-Sender: robert@fledge.watson.org To: Vlad GALU In-Reply-To: Message-ID: <20071205093244.U87930@fledge.watson.org> References: <4755EFDD.8070609@isc.org> <20071205021851.V87930@fledge.watson.org> MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed Cc: freebsd-net@freebsd.org, Peter Losher Subject: Re: Aggregating many ports into one for tcpdump server. X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 05 Dec 2007 09:43:07 -0000 On Wed, 5 Dec 2007, Vlad GALU wrote: >> Depending on the configuration of the system (number of interfaces, number >> of CPUs, etc), you may find that running many tcpdump sessions results on >> greater throughput due to making better use of parallelism. For example, >> if you have eight cores and four interfaces, then you can end up running >> with one ithread and one tcpdump session, each on their own CPU, per >> interface. Of course, if you have many more interfaces than CPUs/pairs, >> then you just end up with much more context-switching, which will hurt >> performance. BTW, if you find you're getting packet loss in BPF processing >> at high rates, we should have you try the zero-copy BPF patches. Finally, >> another configuration you might consider is a single 10gbps card configured >> as a vlan trunk attached to a switch serving the various vlans to various >> switch ports. I'm not sure if that will be faster or lower, but it would >> be different. :-) > > I would like to try the aforementioned patches too. Can you please point me > to a link? You can download our experimental tarball from here: http://www.watson.org/~robert/freebsd/20071103-zcopybpf.tgz You can find a BSDCan quick talk on the topic here: http://www.watson.org/~robert/freebsd/2007bsdcan/20070517-devsummit-zerocopybpf.pdf I've had several reports of significantly improved packet capture rates at high speeds with it, but it's not yet in the tree because we feel it needs more evaluation and review. I hope to ship some form of zero-copy BPF buffer support in FreeBSD 8, and possibly even MFC it. Any feedback you might have would be most helpful. Robert N M Watson Computer Laboratory University of Cambridge