From d8cdc6ab87550de9c93b1f6763ea6015f292d7fb Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Fri, 31 May 2013 15:07:15 +0200 Subject: ring: netsniff-ng: migrate capture only to TPACKET_V3 Lets migrate capturing to TPACKET_V3, since it will bring a better performance due to fewer page cache misses caused by a higher density of packets, since now they are contigous placed in the ring buffer. It is said that TPACKET_V3 brings the following benefits: *) ~15 - 20% reduction in CPU-usage *) ~20% increase in packet capture rate *) ~2x increase in packet density *) Port aggregation analysis *) Non static frame size to capture entire packet payload Signed-off-by: Daniel Borkmann --- dissector.h | 29 ++++++++++++++++++++--------- 1 file changed, 20 insertions(+), 9 deletions(-) (limited to 'dissector.h') diff --git a/dissector.h b/dissector.h index d211e06..2c2c128 100644 --- a/dissector.h +++ b/dissector.h @@ -9,6 +9,7 @@ #include #include +#include #include "ring.h" #include "tprintf.h" @@ -45,31 +46,41 @@ static inline const char *__show_ts_source(uint32_t status) return ""; } -static inline void show_frame_hdr(struct frame_map *hdr, int mode) +static inline void __show_frame_hdr(struct sockaddr_ll *s_ll, + void *raw, int mode, bool v3) { char tmp[IFNAMSIZ]; + union tpacket_uhdr hdr; if (mode == PRINT_NONE) return; + hdr.raw = raw; + switch (mode) { case PRINT_LESS: tprintf("%s %s %u", - packet_types[hdr->s_ll.sll_pkttype] ? : "?", - if_indextoname(hdr->s_ll.sll_ifindex, tmp) ? : "?", - hdr->tp_h.tp_len); + packet_types[s_ll->sll_pkttype] ? : "?", + if_indextoname(s_ll->sll_ifindex, tmp) ? : "?", + v3 ? hdr.h3->tp_len : hdr.h2->tp_len); break; default: tprintf("%s %s %u %us.%uns %s\n", - packet_types[hdr->s_ll.sll_pkttype] ? : "?", - if_indextoname(hdr->s_ll.sll_ifindex, tmp) ? : "?", - hdr->tp_h.tp_len, hdr->tp_h.tp_sec, - hdr->tp_h.tp_nsec, - __show_ts_source(hdr->tp_h.tp_status)); + packet_types[s_ll->sll_pkttype] ? : "?", + if_indextoname(s_ll->sll_ifindex, tmp) ? : "?", + v3 ? hdr.h3->tp_len : hdr.h2->tp_len, + v3 ? hdr.h3->tp_sec : hdr.h2->tp_sec, + v3 ? hdr.h3->tp_nsec : hdr.h2->tp_nsec, + v3 ? "" : __show_ts_source(hdr.h2->tp_status)); break; } } +static inline void show_frame_hdr(struct frame_map *hdr, int mode) +{ + __show_frame_hdr(&hdr->s_ll, &hdr->tp_h, mode, false); +} + extern void dissector_init_all(int fnttype); extern void dissector_entry_point(uint8_t *packet, size_t len, int linktype, int mode); extern void dissector_cleanup_all(void); -- cgit v1.2.3-54-g00ecf