The following libpcap-ringbuffer ebuild supports packet mmap mode, which allows you to setup a kernel space ringbuffer in order to reduce dropped packets when capturing on high speed networks. You don't have to recompile any capture programs such as tcpdump or ethereal, as long as you didn't built them with a static libpcap. To make use of the ringbuffer feature you need to have CONFIG_PACKET_MMAP enabled in your running kernel. On the commandline you can setup some parameters before running your capture program: PCAP_FRAMES=max PCAP_VERBOSE=1 PCAP_TO_MS=0 PCAP_PERIOD=10000 PCAP_STATS=0x1fff tcpdump -i eth0 -s 1514 -w /dev/null -c 100 libpcap version: 1.0 Kernel filter, Protocol 0300, MMAP mode (32760 frames, snapshot 1514), socket type: Raw tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 1514 bytes S:1094557837.516404 100 0 100 0 100 8736 8736 0 107 4 0 000000002.047794 100 packets captured 100 packets received by filter 0 packets dropped by kernel or PCAP_FRAMES=max PCAP_VERBOSE=1 PCAP_TO_MS=0 PCAP_PERIOD=10000 PCAP_STATS=0x1fff ethereal libpcap version: 1.0 Kernel filter, Protocol 0300, NORMAL mode (snapshot 65535), socket type: Raw NOTE FOR GENTOO-STAFF: As we already have a libpcap, it would be useful to have a virtual/libpcap. (For now everybody can smoothly install it over old libpcap.) Regards, Andy.
Created attachment 39120 [details] ebuild for libpcap-ringbuffer should be virtual/libpcap
See with regard to fPIC http://www.gentoo.org/proj/en/devrel/handbook/handbook.xml?part=3&chap=1
Daniel, I didn't get the point, can you get me another hint. The use of "global" fPIC seems right to me as libpcap is a shared library only, no other executable. The big memory allocations for ringbuffer is done by the kernel itself. Further it is the same ebuild "except for the sed line instead of a patchfile" as for the original libpcap.
Ok my mistake - your right. Other things I noticed and I realise these aren't your mistakes: I think there is a preference to use "${CC}" rather than "gcc" although I can't find off hand where its written. Also rather than einstall {e}make DESTDIR=${D} install is prefered. /usr/doc/ should be /usr/share/doc Andreas if your interested in becoming a dev email me (and stop attaching tarballs to bug reports :-) and read through http://www.gentoo.org/proj/en/devrel/handbook/handbook.xml especially the becoming a dev bit.
Created attachment 39494 [details] updated ebuild removed einstall part, changed /usr/share/doc, omitted installing a non-existent 0.7.2 libpcap fPIC schould be tested on different architectures, there could be a relocation problem still.
added net-libs/libpcap-ringbuffer-1.0.20041001.ebuild I still need to do a dev-gentoo email to support a virtual.
virtual added. In the middle of changing dependancies to virtual/libpcap.
transition of dependencies should be complete. Thanks again for the bug.
