Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-17 14:08:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

iosource/pcap: Support configurable buffer size

Browse source 
On Linux with a default ext4 or tmpfs filesystem, the default buffer size for
reading a pcap is chosen as 4k (strace/gdb validated). When reading large pcaps
containing raw data transfers, the syscall overhead for read becomes visible
in profiles. Support configurability of the buffer size and default to 128kb.

When processing a ~830M PCAP (16 UDP connections, each transferring ~50MB) in
bare mode, this change improves runtime from 1.39 sec to 1.29 sec. Increasing
the buffer further didn't provide a noticeable boost.
This commit is contained in:
Arne Welzel 2023-10-09 10:29:57 +02:00
parent c161b1c4b1
commit 7fac5837c3
9 changed files with 63 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
testing/btest/Baseline/core.pcap.input-error/output2
View file

@ -1,3 +1,3 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
fatal error: problem with interface NO_SUCH_INTERFACE
fatal error: problem with trace file NO_SUCH_TRACE (NO_SUCH_TRACE: No such file or directory)
fatal error: problem with trace file NO_SUCH_TRACE (unable to open NO_SUCH_TRACE: No such file or directory)

2
testing/btest/Baseline/core.pcap.wrong-format/output Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
fatal error: problem with trace file not-a.pcap (unknown file format)

2
testing/btest/Baseline/core.pcap.wrong-format/output2 Normal file
View file

@ -0,0 +1,2 @@
### BTest baseline data generated by btest-diff. Do not edit. Use "btest -U/-u" to update. Requires BTest >= 0.63.
fatal error: problem with trace file - (unknown file format)

10
testing/btest/core/pcap/wrong-format.zeek Normal file
View file

@ -0,0 +1,10 @@
# @TEST-REQUIRES: test "${ZEEK_USE_CPP}" != "1"
# @TEST-EXEC-FAIL: zeek -b -r not-a.pcap >output 2>&1
# @TEST-EXEC: btest-diff output
# @TEST-EXEC-FAIL: cat not-a.pcap | zeek -b -r - >output2 2>&1
# @TEST-EXEC: btest-diff output2
@TEST-START-FILE ./not-a.pcap
%PDF-1.5
This isn't an actual pdf file, and neither a PCAP.
@TEST-END-FILE