CODEWITHSUNDEEP
c++linuxnetwork-programminglibpcap
gadon
gadon

Reputation: 41

libpcap (>1.0.0) and PF_RING efficiency

I'm using libpcap 1.4.0 in order to capture packets from/to a device (I'm using linux). I'm suffering from packet loss, and after a research about it, I found PF_RING, and now i'm considering using it.

The problem is, I don't really understand why using PF_RING is more efficient than using libpcap's PF_PACKET, when libpcap's default packet capture method is "zero-copy" (since libpcap 1.0.0), as well as PF_RING's...

Can someone please explain me why, with libpcap 1.0.0 and later, using PF_RING would be still more efficient (if it is actually more efficient) than not using it ?

Thank you in advance! :)

Upvotes: 4

Views: 4131

Answers (1)

Andre Holzner
Andre Holzner

Reputation: 18675

according to https://stackoverflow.com/a/8897187/288875 there is still one copy from the kernel's socket buffer (sk_buff) to the memory you will read. PF_RING seems not to do this copy (as far as I remember does pfring bypass the normal kernel mechanism of handling data received from the network card).

Upvotes: 4

Related Questions