Thanks Mulyadi, <br>Yeah that a final alternative. Actually I was looking for some optimized way of getting packet filtered at kernel level using BPF filter.<br><br><br><div class="gmail_quote">On 21 December 2011 06:22, Mulyadi Santosa <span dir="ltr"><<a href="mailto:mulyadi.santosa@gmail.com">mulyadi.santosa@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0pt 0pt 0pt 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Mukesh..<br>
<div class="im"><br>
On Wed, Dec 21, 2011 at 01:38, Mukesh Yadav <<a href="mailto:mukesh.fkd@gmail.com">mukesh.fkd@gmail.com</a>> wrote:<br>
> BPF filters used are:<br>
> Even IP filter :-> tcpdump -i interface 'ether dst <dest mac> && ip[19] &<br>
> 0x01 = 0'<br>
> Odd IP filter :-> tcpdump -i interface 'ether dst <dest mac> && ip[19] &<br>
> 0x01 = 1'<br>
><br>
> There is a packet loss for odd IP thread even when CPU is available. Reason<br>
> being packet drop due recv buffer full.<br>
> Same amount of traffic is well handled by even IP thread(user code being<br>
> same in both), scaling CPU to full 100%.<br>
><br>
> In odd IP thread, If filter is changed to "tcpdump -i interface 'ether dst<br>
> <dest mac> && ip proto 17' ", all goes fine.<br>
> Also CPU usage at kernel drops from 50% to 4 % for a particular amount of<br>
> traffic.<br>
<br>
</div>I have zero experience with BPF, so this is just my theory.<br>
<br>
In kernel level, (or maybe between kernel and user level), by putting<br>
your odd and even filter, kernel work too hard to separate the packets<br>
into different "queue" or "channel"...or something like that. While in<br>
the mean time, incoming packets are bursting .... This makes buffers<br>
filled up fast.<br>
<br>
How about this... just filter anything that match your target<br>
MAC....fed this up to the user level application and let your<br>
application do the odd and even IP filtering?<br>
<font color="#888888"><br>
--<br>
regards,<br>
<br>
Mulyadi Santosa<br>
Freelance Linux trainer and consultant<br>
<br>
blog: <a href="http://the-hydra.blogspot.com" target="_blank">the-hydra.blogspot.com</a><br>
training: <a href="http://mulyaditraining.blogspot.com" target="_blank">mulyaditraining.blogspot.com</a><br>
</font></blockquote></div><br><br clear="all"><br>-- <br>Cheers<br>Mukesh Yadav<br>Senior Software Engineer<br>Plot6 Sector 18<br>Aricent <br>Gurgaon<br>Mob: 9953024169<br>