Re: Poor performance of SOCK_RAW/PF_PACKET on MacOSX.. (libpcap is better.. sorta..)
Re: Poor performance of SOCK_RAW/PF_PACKET on MacOSX.. (libpcap is better.. sorta..)
- Subject: Re: Poor performance of SOCK_RAW/PF_PACKET on MacOSX.. (libpcap is better.. sorta..)
- From: Vincent Lubet <email@hidden>
- Date: Thu, 13 Feb 2014 15:54:09 -0800
Bob,
You could roll your own socket based solution with the help of the Kernel Control KPI -- see <sys/kern_control.h> and the documentation at https://developer.apple.com/library/mac/documentation/Darwin/Conceptual/NKEConceptual/intro/intro.html
Because the Sockets API is limited to send or receive one datagram at a time, I recommend that you define some aggregate frame format so you may pass more than one packet at a time.
Vincent
On Feb 13, 2014, at 6:02 AM, Robert Monaghan <email@hidden> wrote:
> Hi Everyone,
>
> I am looking for suggestions!
>
> I am working on a software package that reads custom network frames from a hardware device.
> This device works over 10GBaseT and can saturate the network pretty easily. As the data is image data, all of the data is needed.
> Dropped packets during a transfer, means that the entire image has to be re-downloaded.
>
> On Linux, I have sockets based code using SOCK_RAW,PF_PACKET in combination with PF_RING (using a setsockopt command).
> This code is easily able to capture all of the raw packets as they are sent from my hardware device.
> Downloading a bunch of packets with this code results in about 400 to 600Mb/s.
>
> I am struggling to get similar performance with the Mac. (MBP/Retina, MacPro 2010 - 12 Core, 2011 iMac — I have tried several models.)
>
> The first attempt used sockets in a very similar fashion as the code mentioned above, but without any kind of “PF_RING” type memory buffer. I ended up abandoning this approach, as there doesn’t appear to be able to capture all of the packets reliably. I have to throttle the hardware device down to about 50Mb/s just to get all of the packets.
>
> I might as well use Gigabit Ethernet at this point.
>
> I also worked with BPF Filters in libpcap, too. This has provided significantly better performance, but requires you to process each and ever packet as they come in. There is no mechanism to batch a bunch of packets using its pcap_loop() function. Not only that, but each packet has to be copied out of the BPF buffer into your own buffer, adding additional work that has to done during the transfer. (Needless to say, this causes a lot dropped packets, too.)
>
> Is there a way to open a raw socket and reliably capture number of frames into a fast ring buffer? - or -
> Is there a way to have libpcap capture directly into a user land buffer return the buffer when complete?
>
> Am I going to have to “roll my own” BPF based system, reading into some sort of user land buffer?
>
> Thanks!
>
> bob.
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macnetworkprog mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden