Wireshark · Wireshark-dev: Re: [Wireshark-dev] mmap consumes more CPU

[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 5, 2012, at 11:03 AM, abhinav narain <abhinavnarain10@xxxxxxxxx> wrote:

>   I just checked the two mechanism :
> (1) Using mmap to fetch packets from kernel to userspace
> (2) Using recvfrom() call to fetch packets 
> 
> I see top reports 
> (1) 34% memory 20% cpu usage
> (2) 21% memory 7% cpu usage ! 
> 
> I wanted a performance improvement using mmap but I am slowing my small router for packet capture( I can't use pcap for that; I have modified skbuff ) and its worst than twice !

Have you tried running profiled versions of your code to see where the CPU usage is happening?

(By "can't use pcap for that" do you mean that you're not using libpcap, you're using your own code that either reads from the socket or memory-maps the socket?  If so, make sure you're doing the memory-mapped stuff the same way libpcap does - it's *not* trivial to get right, as you'll notice if you see the number of changes that have had to be made to that code.)