简体繁体 English

libpcap（> 1.0.0）和PF_RING效率

[英]libpcap (>1.0.0) and PF_RING efficiency

原文 2013-11-02 13:58:47 4 1 c++/ linux/ networking/ libpcap

I'm using libpcap 1.4.0 in order to capture packets from/to a device (I'm using linux). 我正在使用libpcap 1.4.0来从设备捕获数据包（我正在使用linux）。 I'm suffering from packet loss, and after a research about it, I found PF_RING, and now i'm considering using it. 我正在遭受数据包丢失的困扰，经过对它的研究，我找到了PF_RING，现在我正在考虑使用它。

The problem is, I don't really understand why using PF_RING is more efficient than using libpcap's PF_PACKET, when libpcap's default packet capture method is "zero-copy" (since libpcap 1.0.0), as well as PF_RING's... 问题是，我真的不明白为什么使用PF_RING比使用libpcap的PF_PACKET更有效，当libpcap的默认数据包捕获方法是“零拷贝”（因为libpcap 1.0.0），以及PF_RING的...

Can someone please explain me why, with libpcap 1.0.0 and later, using PF_RING would be still more efficient (if it is actually more efficient) than not using it ? 有人可以解释一下为什么，使用libpcap 1.0.0及更高版本，使用PF_RING比使用它更有效（如果它实际上更有效）？

Thank you in advance! 先感谢您！ :) :)

1 个解决方案

according to https://stackoverflow.com/a/8897187/288875 there is still one copy from the kernel's socket buffer (sk_buff) to the memory you will read. 根据https://stackoverflow.com/a/8897187/288875 ，从内核的套接字缓冲区（sk_buff）到你将要阅读的内存仍有一个副本。 PF_RING seems not to do this copy (as far as I remember does pfring bypass the normal kernel mechanism of handling data received from the network card). PF_RING似乎没有做这个副本（据我所记得，pfring 绕过处理从网卡收到的数据的正常内核机制）。