Messages in this thread | | | From | kuznet@ms2 ... | Subject | Re: Linux and Network Flight Recorder | Date | Thu, 24 Jun 1999 20:55:25 +0400 (MSK DST) |
| |
Hello!
> I was under the impression that they used some hack to mmap a kernel > ring buffer via a character device.
Probably, they do it in their commercial version. It is easy, but the only result is moving towards classic Linux-2.0 performance. 8)
> Their code will run in the IRQ at the end and probably > be rather similar to turbopacket.
I emphasize, turbopacket DOES NOT give any advantages comparing to Linux-2.0 packet socket, when all the data from network are copied to user level app. Turbopacket is real advantage, when sniffier needs to know only small part of packet or when sniffer works not on dedicated server, but used to debug real router/host traffic. It was designed to help in debugging minimally violating real data flow. All this does not apply to NFR at all, if their main task is not to analyze contents of syn floods 8)
What's about work on IRQ, it IS real advantage. But again, not for NFR. Latency/memory bandwidth overhead provided by standard Linux is neglibible comparing to huge NFR overhead.
> And lots of time writing data to disk + a complex multi process setup.
Exactly. And NFR is even closely not optimal in this sense.
To be fair, if they desired they could be just happy with linux-2.0 packet socket. Translation their marketing problems to problems of linux kernel is ridiculous and does not worth an attention. Actually, I reacted only because their silly blether threatens to become common opinion, they blather much more than really produce and in an inacceptable tone.
Alexey
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |