Re: Bridge--using Packet Capture Library(libpcap.a) -- efficiency ?????

From: Robert Watson (rwatson_at_freebsd.org)
Date: 10/31/04

  • Next message: Sean Chittenden: "Irritation regarding precision of ping(8)..."
    Date: Sun, 31 Oct 2004 09:44:17 +0000 (GMT)
    To: kamal kc <rosey_kc@yahoo.com>
    
    

    On Sun, 31 Oct 2004, kamal kc wrote:

    > I have made a bridge using the Packet Capture Library I set the two nics
    > to promiscous mode and transfer packet between the two packet capture
    > handles A piece of the code I use for initializing the packet capture

    Copying every packet into and out of user space along with the at least
    two system calls to do each packet will necessarily be expensive.
    However, 3ms sounds far to high to me, do you have other processes running
    (such as tcpdump) that might result in additional context switches?

    I have used BPF to do bridging previously with a lot of success; I have
    some sample code bridging over a tap interface and a TCP socket -- the
    source (functional but not pretty) is at:

        http://www.watson.org/~robert/freebsd/netbridge/

    The only complicated bit is walking through the BPF buffer, where sample
    code is invaluable. Everything else is very straight forward. If you're
    doing a bridge, you probably want to set the BPF flag so you don't loop
    any packets.

    Robert N M Watson FreeBSD Core Team, TrustedBSD Projects
    robert@fledge.watson.org Principal Research Scientist, McAfee Research

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"


  • Next message: Sean Chittenden: "Irritation regarding precision of ping(8)..."

    Relevant Pages

    • Re: Ethereal - not sufficient permission?
      ... >>You need root privilege to use Ethereal ... > Only in packet capture mode. ... > a previously recorded packet trace. ... > ethereal binary tends to crash the whole system if run in packet capture ...
      (comp.os.linux.networking)
    • Re: Linksys WAP11 & corrupt SNMP packets
      ... it is a "packet capture" from the Linksys WAP11 itself - ... Without a decoder knowing ... > packet is corrupt or badly encoded, since there is no data in the ...
      (comp.security.firewalls)
    • Re: Firewall IM Driver Help
      ... source for the driver hook? ... Libpcap is 'packet capture' but has it 'packet filtering' ... I find free 'packet capture' but 'packet filtering' source is very much money. ...
      (microsoft.public.development.device.drivers)
    • RE: Increase seen in port probes since Tuesday afternoon
      ... > the number of machines probing my network on ports 2745, ... Packet captures might reveal whether there is anything new or interesting ... Again a packet capture would show whether or not this ...
      (Incidents)
    • Re: libpcap perf improvement? latest ideas?
      ... performance (with comparison of linux and freebsd) I searched freebsd resources for pcap improvements. ... I agree that a reference model can be used to reduce the number of copies done currently for BPF. ... In PF_PACKET you are forced to do a system call per-acquisition and another system for receiving the time-stamp of the last packet read for example. ... I proposed a model that allows for dynamic ring buffer size and signaling for soft and hard-limits to allow application buffering to handle potential drops. ...
      (freebsd-hackers)