[Snort-devel] Re: [Ethereal-dev] Re: Fwd: kyxtech: freebsd outsniffed by wintendo !!?!?
gharris at ...148...
Fri Dec 8 03:38:39 EST 2000
On Thu, Dec 07, 2000 at 11:39:58PM -0800, Guy Harris wrote:
> Or, as per my other mail, perhaps using, on Windows, a version of the
> standard I/O library that does bigger writes, hence fewer system calls.
Nope. According to "strace for NT":
and the Windows(R) NT(R)/2000 Native API Reference:
it's doing 4K writes in the underlying NT system call "NtWriteFile()".
I suspect that running the test on FreeBSD 4.x and tweaking libpcap to
use a 512KB buffer might make a big difference here.
At this point, we might want to limit followups to one or more of:
tcpdump-workers at ...142... - for discussing changes to libpcap
to allow the buffer size to be set from an application and/or
changing the size it initially tries on BSD (the current version
in CVS starts at 32768 and keeps dividing that in half until it
finds something that works);
freebsd-hackers at ...144..., tech at ...76... - for discussing
changes to allow the buffer size to be changes with BIOCSBLEN
even if the BPF device is attached to an interface.
(Both FreeBSD and OpenBSD have the maximum buffer size for BPF as 512KB
in the top of the CVS tree; NetBSD still has it as 32K.)
More information about the Snort-devel