Ethereal-dev: [Ethereal-dev] Re: about the limit of packet size

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 27 Oct 2004 00:24:35 -0700
À½­ wrote:

When I use the limit of packet size with 68 byte in the capture options to capture
the packets in GigeByte network,the dropped packets is about 30%.But When I don't
limit the packet size in the capture options,The rate of dropped of packets is
50%. Why is it?
Because the larger the packet size, the more data has to be copied from the kernel's buffers to libpcap's buffer, and thus the more CPU time, bus bandwidth, and disk bandwidth has to be used. If CPU time, bus bandwidth, or disk bandwidth is the resource that's scarce, reducing the CPU time, bus bandwidth, and/or disk bandwidth used could increase the number of packets that could be captured. 


It is necessary to limit the packet size to improve the
performance of the capture and lose the dropped packets????
Possibly. Changing operating systems, or packet capture mechanisms, might help; see, for example: 

	http://luca.ntop.org/Ring.pdf