diff options
| author | Daniel Borkmann <dborkman@redhat.com> | 2013-05-26 16:05:55 +0200 |
|---|---|---|
| committer | Daniel Borkmann <dborkman@redhat.com> | 2013-05-26 16:05:55 +0200 |
| commit | 23bbec5adad6e6f223c44abf22a81914ad15f61c (patch) | |
| tree | db45cf6da33e8672f32775c7daa410246dc3aa3c /netsniff-ng.8 | |
| parent | dca4a1c8eaf1c2d20a6a9b5644603a15283b4df7 (diff) | |
man: netsniff-ng: add note about multithreading
Add a paragraph about multi-threading with netsniff-ng.
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Diffstat (limited to 'netsniff-ng.8')
| -rw-r--r-- | netsniff-ng.8 | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/netsniff-ng.8 b/netsniff-ng.8 index 395382f..5bdc6d0 100644 --- a/netsniff-ng.8 +++ b/netsniff-ng.8 @@ -54,6 +54,15 @@ state or perform reassembly during packet dissection, its memory footprint is qu low, thus, making netsniff-ng quite efficient for offline analysis of large pcap files as well. .PP +Note that netsniff-ng is currently not multithreaded. However, this does not +prevent you from starting multiple netsniff-ng instances that are pinned to +different, non-overlapping CPUs and f.e. have different BPF filters attached. +Likely that at some point in time your harddisc might become a bottleneck +assuming you do not rotate such pcaps in ram (and from there periodically +scheduled move to slower medias). You can then use mergecap(1) to transform +all pcaps into a single large pcap. Thus, netsniff-ng then works multithreaded +eventually. +.PP .SH OPTIONS .PP .SS -i <dev|pcap|->, -d <dev|pcap|->, --in <dev|pcap|->, --dev <dev|pcap|-> |