Re: Aggregating many ports into one for tcpdump server.

2007-12-05 Thread Vlad GALU
On 12/5/07, Robert Watson <[EMAIL PROTECTED]> wrote: > > On Wed, 5 Dec 2007, Robert Watson wrote: > > > On Wed, 5 Dec 2007, Vlad GALU wrote: > > > >> I would like to try the aforementioned patches too. Can you please point me > >> to a link? > > > > You can download our experimental tarball from he

Re: Aggregating many ports into one for tcpdump server.

2007-12-05 Thread Robert Watson
On Wed, 5 Dec 2007, Robert Watson wrote: On Wed, 5 Dec 2007, Vlad GALU wrote: I would like to try the aforementioned patches too. Can you please point me to a link? You can download our experimental tarball from here: http://www.watson.org/~robert/freebsd/20071103-zcopybpf.tgz You can fin

Re: Aggregating many ports into one for tcpdump server.

2007-12-05 Thread Robert Watson
On Wed, 5 Dec 2007, Vlad GALU wrote: Depending on the configuration of the system (number of interfaces, number of CPUs, etc), you may find that running many tcpdump sessions results on greater throughput due to making better use of parallelism. For example, if you have eight cores and four

Re: Aggregating many ports into one for tcpdump server.

2007-12-05 Thread Vlad GALU
On 12/5/07, Robert Watson <[EMAIL PROTECTED]> wrote: > > On Tue, 4 Dec 2007, Peter Losher wrote: > > > I am currently working on a tcpdump collector where we have multiple feeds > > coming in (via bge{0-8}). Since tcpdump can only poll one interface per > > process, I was hoping to aggregate the t