lkml.org 
[lkml]   [1999]   [Jun]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: Linux and Network Flight Recorder
Date
Hello!

> I was under the impression that they used some hack to mmap a kernel
> ring buffer via a character device.

Probably, they do it in their commercial version. It is easy,
but the only result is moving towards classic Linux-2.0 performance. 8)

> Their code will run in the IRQ at the end and probably
> be rather similar to turbopacket.

I emphasize, turbopacket DOES NOT give any advantages comparing to
Linux-2.0 packet socket, when all the data from network are copied
to user level app. Turbopacket is real advantage, when sniffier
needs to know only small part of packet or when sniffer works not on
dedicated server, but used to debug real router/host traffic.
It was designed to help in debugging minimally violating real data flow.
All this does not apply to NFR at all, if their main task is not to analyze
contents of syn floods 8)

What's about work on IRQ, it IS real advantage. But again, not for NFR.
Latency/memory bandwidth overhead provided by standard Linux
is neglibible comparing to huge NFR overhead.

> And lots of time writing data to disk + a complex multi process setup.

Exactly. And NFR is even closely not optimal in this sense.

To be fair, if they desired they could be just happy with linux-2.0
packet socket. Translation their marketing problems to problems of linux kernel
is ridiculous and does not worth an attention. Actually, I reacted
only because their silly blether threatens to become common opinion,
they blather much more than really produce and in an inacceptable tone.

Alexey

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:52    [W:0.053 / U:0.368 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site