From 23bbec5adad6e6f223c44abf22a81914ad15f61c Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Sun, 26 May 2013 16:05:55 +0200 Subject: man: netsniff-ng: add note about multithreading Add a paragraph about multi-threading with netsniff-ng. Signed-off-by: Daniel Borkmann --- netsniff-ng.8 | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'netsniff-ng.8') diff --git a/netsniff-ng.8 b/netsniff-ng.8 index 395382f..5bdc6d0 100644 --- a/netsniff-ng.8 +++ b/netsniff-ng.8 @@ -54,6 +54,15 @@ state or perform reassembly during packet dissection, its memory footprint is qu low, thus, making netsniff-ng quite efficient for offline analysis of large pcap files as well. .PP +Note that netsniff-ng is currently not multithreaded. However, this does not +prevent you from starting multiple netsniff-ng instances that are pinned to +different, non-overlapping CPUs and f.e. have different BPF filters attached. +Likely that at some point in time your harddisc might become a bottleneck +assuming you do not rotate such pcaps in ram (and from there periodically +scheduled move to slower medias). You can then use mergecap(1) to transform +all pcaps into a single large pcap. Thus, netsniff-ng then works multithreaded +eventually. +.PP .SH OPTIONS .PP .SS -i , -d , --in , --dev -- cgit v1.2.3-54-g00ecf