Hacker News Reader

I wonder if this would work with PF_RING[1] from the ntop guys? Regular libpcap drops packets quite a bit at 10G+ speeds when you have adaptive coalescing disabled on the network card.

[1] http://www.ntop.org/products/pf_ring/

View on HN

PF_RING is an option but it requires a kernel module and specific network cards. Before then, the memory map sniffing feature of the Linux kernel [1] can improve libpcap performance. Not quite to 10G speeds, though, but I think enough for most cases :-)

[1]: http://www.cs.fsu.edu/~baker/devices/lxr/http/source/linux/D...

Any plans to support it? Part of my job (historically) has been building line rate pcap appliances that do pcaps at nanosecond resolution (using endace cards, Mellanox, or solarflare). PF_RING is a bit tricky to get working, but is completely flawless when you get it running.

This software looks fantastic however.

Reply on news.ycombinator.com