Wireshark-dev: Re: [Wireshark-dev] dumpcap performance?
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 22 Feb 2013 14:48:46 -0800
On Feb 22, 2013, at 1:39 PM, Jeff Morriss <jeff.morriss.ws@xxxxxxxxx> wrote:

> Basically you're proposing building one bigger buffer for writing rather than doing several smaller writes?
> 
> My experience would say no: memcpy()s should be avoided whenever possible.  Admittedly my experience does not include a lot of file I/O but I would think/hope the OS would do a good job of buffering smaller writes into larger I/Os.

If standard I/O (FILE *'s) is being used, doing extra copies into a buffer and a single fwrite() will probably hurt rather than helping, as standard I/O does the buffering in userland, so the copies into a buffer (which is probably somewhere between 4K and 8K in size, but may be larger) are already being done by fwrite().  We're using standard I/O in that code path.

If write() were being used directly, doing extra copies into the buffer and a single write() *might* help, as, while there is buffering being done in the kernel, you would be making more system calls with multiple write()s.  (That's one reason for the standard I/O library - it does that buffering for you.)