Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] mmap consumes more CPU

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 8 Nov 2012 14:29:12 -0800
On Nov 5, 2012, at 11:03 AM, abhinav narain <abhinavnarain10@xxxxxxxxx> wrote:

>   I just checked the two mechanism :
> (1) Using mmap to fetch packets from kernel to userspace
> (2) Using recvfrom() call to fetch packets 
> 
> I see top reports 
> (1) 34% memory 20% cpu usage
> (2) 21% memory 7% cpu usage ! 
> 
> I wanted a performance improvement using mmap but I am slowing my small router for packet capture( I can't use pcap for that; I have modified skbuff ) and its worst than twice !

Have you tried running profiled versions of your code to see where the CPU usage is happening?

(By "can't use pcap for that" do you mean that you're not using libpcap, you're using your own code that either reads from the socket or memory-maps the socket?  If so, make sure you're doing the memory-mapped stuff the same way libpcap does - it's *not* trivial to get right, as you'll notice if you see the number of changes that have had to be made to that code.)