James Harton | 11 Sep 09:55
Favicon

Public.Network.Pcap

Hi there.

Does anyone have any example code for using Public.Network.Pcap?

Cheers.

James.

Gravatar

Re: Public.Network.Pcap

I do, somewhere... I'll have to dig around for it.

Bill

On Sep 11, 2008, at 3:56 AM, James Harton wrote:

> Hi there.
>
> Does anyone have any example code for using Public.Network.Pcap?
>
> Cheers.
>
> James.
>

James Harton | 22 Sep 00:43
Favicon

Re: Public.Network.Pcap


Hi guys.

I get the following error from Thread.Queue when tracing fast transfers 
- the Queue seems very bursty even with 10 workers, and seems to build 
up before unblocking the read() calls.

It's only using about 0.5% CPU and hardly any RAM, so it's not that the 
machine can't handle it:

Svalue stack overflow. (99624 of 100000 entries on stack, needed 256 
more entries)
/usr/lib/pike/7.6.93/lib/modules/Thread.pmod:373: 
Thread.Thread(0).Queue(38950)->write(mapping[5])
/usr/lib/pike/7.6.93/lib/modules/Public.pmod/Network.pmod/Pcap.pmod:6: 
Public.Network.Pcap.Pcap()->loop(0)

The code I'm using is:

int main() {
  queue = Thread.Queue();
  threads = ({});
  for (int i; i < THREADS; i++)
    threads += ({ Thread.thread_create(worker) });
  fe = IP.FlowEngine();
  object cap = Public.Network.Pcap.Pcap();
  cap->set_capture_callback(queue->write);
  //cap->set_capture_callback(capture_cb);
  cap->set_capture_length(MTU);
  cap->open_live(IF);
(Continue reading)

Bertrand LUPART | 22 Sep 09:24
Favicon

Re: Public.Network.Pcap

Hello,

> Svalue stack overflow. (99624 of 100000 entries on stack, needed 256 
> more entries)
> /usr/lib/pike/7.6.93/lib/modules/Thread.pmod:373: 
> Thread.Thread(0).Queue(38950)->write(mapping[5])
> /usr/lib/pike/7.6.93/lib/modules/Public.pmod/Network.pmod/Pcap.pmod:6:
> Public.Network.Pcap.Pcap()->loop(0)

Looks like your are using the package pike7.6-7.6.93-1 from Debian etch
which is known to be buggy.

Maybe try the ones from Henrik.

Add the following to your /etc/sources.list:
----8<----8<----8<----8<----
deb http://debian.han.pp.se/debian/ stable main
---->8---->8---->8---->8----
and install 7.6.112

As a side note, all the Debian etch packages installing code from
modules.gotpike.org (pike7.6-public*) are compiled for 7.6.93.
They aren't available from debian.han.pp.se for 7.6.112 and you'll have
to rebuild them yourself using monger:
http://modules.gotpike.org/docs/UsingMonger.html

--

-- 
Bertrand LUPART

http://bertrand.gotpike.org/
(Continue reading)

Henrik Grubbström | 13 Oct 11:28
Favicon

Re: Public.Network.Pcap

On Mon, 22 Sep 2008, James Harton wrote:

> Hi guys.
>
> I get the following error from Thread.Queue when tracing fast transfers - the 
> Queue seems very bursty even with 10 workers, and seems to build up before 
> unblocking the read() calls.
>
> It's only using about 0.5% CPU and hardly any RAM, so it's not that the 
> machine can't handle it:
>
> Svalue stack overflow. (99624 of 100000 entries on stack, needed 256 more 
> entries)
> /usr/lib/pike/7.6.93/lib/modules/Thread.pmod:373: 
> Thread.Thread(0).Queue(38950)->write(mapping[5])
> /usr/lib/pike/7.6.93/lib/modules/Public.pmod/Network.pmod/Pcap.pmod:6: 
> Public.Network.Pcap.Pcap()->loop(0)
>
> The code I'm using is:
>
[...]
> queue = Thread.Queue();
[...]
> void worker() {
> while(mixed args = queue->read()) {
>   low_capture_cb(@({ args }));

Looks like the arrays stored in the queue are too large to use with the 
splice operator.

(Continue reading)


Gmane