libpcap添加過濾規(guī)則后，捕包性能反而下降，求解

whhitdragon

我最經(jīng)在學(xué)習(xí)使用libpcap捕獲網(wǎng)絡(luò)數(shù)據(jù)包，在沒有設(shè)置bpf過濾規(guī)則時，捕獲的的流量可以在50M，而添加過濾規(guī)則后，捕獲的流量反而下降了，這是怎么回事啊，求解！�。。�

例如：

在不添加bpf規(guī)則的時候，使用儀器發(fā)送50M的HTTP流量，設(shè)備cpu到達(dá)98%

而添加bpf規(guī)則，tcp port 80 ，使用儀器發(fā)送30MHTTP流量的時候，設(shè)備的cpu就達(dá)到98%了

這是什么原因��？ 我覺得應(yīng)該是二種情況下，支持的流量一樣才對啊，求解求解！�。�！

jhl19880722

回復(fù) 1# whhitdragon
你添加了過濾就相當(dāng)于把數(shù)據(jù)包捕獲下來以后在對內(nèi)容進(jìn)行了一下比較，如果你在截獲數(shù)據(jù)包后沒有對數(shù)據(jù)包進(jìn)行處理，那么這樣性能下降也是可以理解的吧。


   

shamofeiyu

如果是抓包性能瓶頸，可以試試PF_RING

whhitdragon

使用PF_RING后，捕包性能能夠提高多少？ 您有沒有對應(yīng)的使用文檔？ 有的話能否給小弟一些，謝謝了！ 回復(fù) 3# shamofeiyu


   

shamofeiyu

回復(fù) 4# whhitdragon


    http://www.ntop.org/products/pf_ring/ 上面介紹的很詳細(xì)了

whhitdragon

回復(fù) 5# shamofeiyu
在交叉編譯環(huán)境下怎么編譯？ 需要重寫makefile 嗎？



   

shamofeiyu

回復(fù) 6# whhitdragon

老版本有交叉編譯的腳本，但是新版本好像沒有了

1. #!/bin/sh
   
2. 
   
3. #
   
4. # Simple file for cross-compiling PF_RING on ARM
   
5. #
   
6. make -C ../../kernel/linux-feroceon_5_0_3_KW SUBDIRS=/home/deri/ARM/PF_RING/kernel EXTRA_CFLAGS='-I/home/deri/ARM/PF_RING/kernel' ARCH=arm CROSS_COMPILE=arm-mv5sft-linux-gnueabi- modules
   

復(fù)制代碼

whhitdragon

回復(fù) 7# shamofeiyu

非常感謝 shamofeiyu

我按照你的方法編譯后，可以在arm下面安裝了。

現(xiàn)在按照pf_ring中的UsersGuide說明編譯libpfring 和 libpcap ，編譯命令如下：

cd ${PF_RING}/userland/lib
./configure
make CROSS_COMPILE=￥{SDK_DIR}/staging_dir/toolchain-arm_v5te_gcc-4.4.3_uClibc-0.9.30.1_eabi/usr/bin/arm-openwrt-linux-

出現(xiàn)下面錯誤提示：


ar x libs/libpfring_zero_i686.a
ar x libs/libpfring_dna_i686.a
ar x libs/libpfring_mod_virtual_i686.a
/home/xxx/xxx/staging_dir/toolchain-arm_v5te_gcc-4.4.3_uClibc-0.9.30.1_eabi/usr/bin/arm-openwrt-linux-gcc -Wall -fPIC -I../../kernel -I../../vPF_RING/guest/kernel -I../libpcap -D HAVE_ZERO -D HAVE_DNA -D HAVE_VIRTUAL  -D ENABLE_BPF   -O2  -c pfring.c -o pfring.o
In file included from pfring.c:21:
pfring.h:263: error: expected specifier-qualifier-list before 'pthread_rwlock_t'
pfring.c: In function 'pfring_open':
pfring.c:151: warning: implicit declaration of function 'pthread_rwlock_init'
pfring.c:151: error: 'pfring' has no member named 'rx_lock'
pfring.c:152: error: 'pfring' has no member named 'tx_lock'
pfring.c: In function 'pfring_close':
pfring.c:251: warning: implicit declaration of function 'pthread_rwlock_destroy'
pfring.c:251: error: 'pfring' has no member named 'rx_lock'
pfring.c:252: error: 'pfring' has no member named 'tx_lock'
pfring.c: In function 'pfring_set_reflector_device':
pfring.c:293: error: 'pfring' has no member named 'reflector_socket'
pfring.c:296: error: 'pfring' has no member named 'reflector_socket'
pfring.c:298: error: 'pfring' has no member named 'reflector_socket'
pfring.c:299: error: 'pfring' has no member named 'reflector_socket'
pfring.c:300: error: 'pfring' has no member named 'reflector_socket'
pfring.c: In function 'pfring_recv':
pfring.c:505: error: 'pfring' has no member named 'reflector_socket'
pfring.c:506: error: 'pfring' has no member named 'reflector_socket'
pfring.c: In function 'pfring_send':
pfring.c:623: warning: implicit declaration of function 'pthread_rwlock_wrlock'
pfring.c:623: error: 'pfring' has no member named 'tx_lock'
pfring.c:628: warning: implicit declaration of function 'pthread_rwlock_unlock'
pfring.c:628: error: 'pfring' has no member named 'tx_lock'
pfring.c: In function 'pfring_send_ifindex':
pfring.c:649: error: 'pfring' has no member named 'tx_lock'
pfring.c:654: error: 'pfring' has no member named 'tx_lock'
pfring.c: In function 'pfring_send_parsed':
pfring.c:672: error: 'pfring' has no member named 'tx_lock'
pfring.c:677: error: 'pfring' has no member named 'tx_lock'
pfring.c: In function 'pfring_send_get_time':
pfring.c:700: error: 'pfring' has no member named 'tx_lock'
pfring.c:705: error: 'pfring' has no member named 'tx_lock'


   

shamofeiyu

回復(fù) 8# whhitdragon


    最近好忙，是不是包含了DNA模式的庫了

ar x libs/libpfring_zero_i686.a
ar x libs/libpfring_dna_i686.a
ar x libs/libpfring_mod_virtual_i686.a

這個是DNA模式的二進(jìn)制庫，可以吧他們?nèi)サ�，因�(yàn)樗麄兪莤86編譯的，DNA模式是PF_RING中性能更好的抓包方案，但是他們沒有開放源代碼

daxia1wang

回復(fù) 1# whhitdragon


    哥，過濾規(guī)則怎么設(shè)置�。壳笾鷞:3_200:}