Niall O Broin wrote:
> On 11 Feb 2006, at 00:08, Niall O Broin wrote:
>>> I have a SLES box on which I'm trying to run tcpdump. However, when I do
>>>> tcpdump -i eth0
>>>> I get
>>>> tcpdump: socket: Address family not supported by protocol
>>>> A little research shows that I need a kernel with CONFIG_PACKET
>> enabled to allow tcpdump to work. The kernel on this box has
>> CONFIG_PACKET set to m in the kernel config file.
>>>> So, what module do I load to enable CONFIG_PACKET? Or what else
>> needs doing?
>>> Found it (af_packet) - go back to sleep :-)
Strange core functionality like that is a module?
I wonder is it is it using CONFIG_PACKET_MMAP?
With that method there are no syscalls done per packet,
whereas the traditional method used 2 syscalls per packet!
One to copy the data and the other to timestamp the packet.
af_packet uses a MMAP buffer to synchronise between the
kernel and userspace app.
I wrote a packet capture app 3 years ago now using af_packet,
and I was able to go from 20Kpps to 1.3Mpps captured and analysed
packets with no drops on a 3.2GHz P4 Xeon (mem bandwidth was the
bottleneck).
Pádraig.
Maintained by the ILUG website team. The aim of Linux.ie is to
support and help commercial and private users of Linux in Ireland. You can
display ILUG news in your own webpages, read backend
information to find out how. Networking services kindly provided by HEAnet, server kindly donated by
Dell. Linux is a trademark of Linus Torvalds,
used with permission. No penguins were harmed in the production or maintenance
of this highly praised website. Looking for the
Indian Linux Users' Group? Try here. If you've read all this and aren't a lawyer: you should be!
