[lug] Userland transfers

Nate Duehr nate at natetech.com
Thu Apr 19 00:17:19 MDT 2001

On Wed, Apr 18, 2001 at 10:19:13PM -0700, mohan kumar wrote:
> hi guys,
> I saw a year old discussion in linux-kernel saying
> something like 100% packet sniffing (and moving all
> the packet data to kernel)is hard to achive in linux.I
> am writing a sniffer application(im no craker...im
> doing this for my company :-)) which registers itself
> for packet notification, and when a packet arrives i
> copy it to user land for more processing. Will my
> strategy work with full fledged, duplex, 100MBps
> networks? Or should i make some hacks in the
> core/net.c,mmap(for faster userland transactions) and
> do a kernel recompile? which of these strategies is
> good? 
> (Anyway iam sure what ever strategy i use will give
> good performance than windows, which is in dislike to
> my boss who stands by windows :-( and we end up
> fighting.Huh)

You may be reinventing the wheel -- if there's kernel level support for
capturing packets, surely that will always be more efficient then a
user-space application trying to do the same thing.

I think also the 2.4 kernels have the ability to pass packets directly
to user-space anyway -- so either half your code is done for you
already, or you could focus efforts on helping with kernel patches to
fix any speed issues you see there.  (?)

Nate Duehr <nate at natetech.com>

GPG Key fingerprint = DCAF 2B9D CC9B 96FA 7A6D AAF4 2D61 77C5 7ECE C1D2
Public Key available upon request, or at wwwkeys.pgp.net and others.

More information about the LUG mailing list