[tcpdump-workers] TPACKET_V3 support added big packet delivery delay and/or affected timestamps

Thomas Habets thomas at habets.se
Thu Dec 4 13:13:14 EST 2014


Affected releases: 1.5.0 and up.

Steps to reproduce:
git checkout -f libpcap-1.5.0
./configure --prefix=/opt/badpcap && make && make install
git clone github.com/ThomasHabets/arping
cd arping
./boostrap.sh
./configure && make
LD_PRELOAD=/opt/badpcap/lib/libpcap.so ./src/arping your.local.next.hop

Actual behaviour:
$ sudo sh -c "LD_PRELOAD=$HOME/opt/buggypcap/lib/libpcap.so ./arping 10.0.0.1"
ARPING 10.0.0.1
60 bytes from 00:xx:xx:xx:xx:xx (10.0.0.1): index=0 time=52.633 msec
60 bytes from 00:xx:xx:xx:xx:xx (10.0.0.1): index=1 time=90.928 msec
60 bytes from 00:xx:xx:xx:xx:xx (10.0.0.1): index=2 time=115.183 msec
60 bytes from 00:xx:xx:xx:xx:xx (10.0.0.1): index=3 time=285.153 msec
^C
--- 10.0.0.1 statistics ---
4 packets transmitted, 4 packets received,   0% unanswered

Expected (and received with 1.4.0):
$ sudo sh -c "LD_PRELOAD=$HOME/opt/goodpcap/lib/libpcap.so ./arping 10.0.0.1"
ARPING 10.0.0.1
60 bytes from 00:xx:xx:xx:xx:xx (10.0.0.1): index=0 time=817.060 usec
60 bytes from 00:xx:xx:xx:xx:xx (10.0.0.1): index=1 time=895.977 usec
60 bytes from 00:xx:xx:xx:xx:xx (10.0.0.1): index=2 time=759.840 usec
60 bytes from 00:xx:xx:xx:xx:xx (10.0.0.1): index=3 time=827.074 usec
^C
--- 10.0.0.1 statistics ---
4 packets transmitted, 4 packets received,   0% unanswered

Notice the unit difference. About a hundred milliseconds vs about 800
microseconds.

What appears to be the relevant commit:
https://github.com/the-tcpdump-group/libpcap/commit/8ada1d5b98ac62c4ae9acbecb0639beeebd8a359

Questions:
Is TPACKET V3 (and V2?) much slower than V1? Can I disable them?

Is this actual delay, or just a different way of measuring?

-- 
typedef struct me_s {
 char name[]      = { "Thomas Habets" };
 char email[]     = { "thomas at habets.pp.se" };
 char kernel[]    = { "Linux" };
 char *pgpKey[]   = { "http://www.habets.pp.se/pubkey.txt" };
 char pgp[] = { "A8A3 D1DD 4AE0 8467 7FDE  0945 286A E90A AD48 E854" };
 char coolcmd[]   = { "echo '. ./_&. ./_'>_;. ./_" };
} me_t;


More information about the tcpdump-workers mailing list