Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

iosource/pcap: Support configurable buffer size

Browse source 
On Linux with a default ext4 or tmpfs filesystem, the default buffer size for
reading a pcap is chosen as 4k (strace/gdb validated). When reading large pcaps
containing raw data transfers, the syscall overhead for read becomes visible
in profiles. Support configurability of the buffer size and default to 128kb.

When processing a ~830M PCAP (16 UDP connections, each transferring ~50MB) in
bare mode, this change improves runtime from 1.39 sec to 1.29 sec. Increasing
the buffer further didn't provide a noticeable boost.
This commit is contained in:
Arne Welzel 2023-10-09 10:29:57 +02:00
parent c161b1c4b1
commit 7fac5837c3
9 changed files with 63 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
scripts/base/init-bare.zeek
View file

@ -5286,6 +5286,11 @@ export {
## interfaces.
const bufsize = 128 &redef;
## Number of bytes to use for buffering file read operations when reading
## from a PCAP file. Setting this to 0 uses operating system defaults
## as chosen by fopen().
const bufsize_offline_bytes = 128 * 1024 &redef;
## Default timeout for packet sources without file descriptors.
##
## For libpcap based packet sources that do not provide a usable