libpcap还是PF_PACKET? [英] libpcap or PF_PACKET?

问题描述

我理解这个问题已经讨论了很多次:我应该使用libpcap还是PF_PACKET(数据链接套接字)来捕获数据包?

I understand this question has been discussed many times: Should I use libpcap or PF_PACKET (the data link socket) to capture packets?

根据我的研究，主要由于其可移植性，几乎在所有地方都建议在PF_PACKET上使用libpcap.

Based on my research, libpcap is suggested over PF_PACKET almost everywhere, mainly due to its portability.

但是，对于我当前的项目(在生产系统中使用的项目)，可移植性根本不是问题，我只关心性能(速度，丢包率).我的程序在CentOS 5.10(内核2.6.18)上运行 据我所知，libpcap在每个数据包上都添加了时间戳.这会造成很大的性能损失吗? 还有其他因素使libpcap不适合在高速网络中使用吗?

However, for my current project (which is used in a production system), portability is not a concern at all, all I care about is performance (speed, packet loss ratio). My program is running on CentOS 5.10 (kernel 2.6.18) As far as I know, libpcap put a timestamp on each packet. Does this cause big performance loss? Are there other factors that make libpcap unsuitable in a high-speed network?

推荐答案

据我所知，libpcap在每个数据包上都添加了时间戳.

As far as I know, libpcap put a timestamp on each packet.

否，libpcap从它使用的OS数据包捕获机制获取该数据包的时间戳-在Linux上是...

No, libpcap gets a timestamp for the packet from the OS packet capture mechanism that it uses - which, on Linux is...

... PF_PACKET套接字.

...PF_PACKET sockets.

Linux内核对传入的数据包进行时间戳记. PF_PACKET套接字有多种读取方法:

The Linux kernel time stamps incoming packets. PF_PACKET sockets have multiple ways of reading from them:

• 常规套接字接收，为此，您可以使用显式的ioctl获得时间戳(这样可以避免将其提取到用户空间，但是您不能避免内核在其中对数据包加时间戳记)首先； libpcap在使用常规套接字接收时，总是要求时间戳记；
• 映射内存的访问，总是提供时间戳.

• regular socket receives, for which you can either get a time stamp with an explicit ioctl (so you can avoid fetching it to userland, but you can't avoid the kernel time stamping the packet in the first place; libpcap, when using regular socket receives, always asks for the time stamp);
• memory-mapped access, which always supplies the time stamp.

Libpcap会在可用时使用内存映射访问.如果您关心捕获性能，那么您可能也希望这样做.但是，它不容易使用.

Libpcap uses memory-mapped access whenever it's available; if you care about capture performance, you probably want to do so as well. It's not easy to use, however.

这篇关于libpcap还是PF_PACKET?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！