Prev: denyhosts
Next: After set master mode can't see essid from other laptop
From: lancer6238 on 29 Mar 2010 23:12
Hi all,

I've been reading about what happens after packets are captured by
NICs, and the more I read, the more I'm confused.

Firstly, I've read that traditionally, after a packet is captured by
the NIC, it gets copied to a block of memory in the kernel space, then
to the user space for whatever application that then works on the
packet data. Then I read about DMA, where the NIC directly copies the
packet into memory, bypassing the CPU. So is the NIC -> kernel memory -
> User space memory flow still valid? Also, do most NIC (e.g. Myricom)
use DMA to improve packet capture rates?

Secondly, does RSS (Receive Side Scaling) work similarly in both
Windows and Linux systems? I can only find detailed explanations on
how RSS works in MSDN articles, where they talk about how RSS (and MSI-
X) works on Windows Server 2008. But the same concept of RSS and MSI-X
should still apply for linux systems, right?

Thank you.

Regards,
Rayne
From: JimR on 30 Mar 2010 01:03
lancer6238(a)yahoo.com wrote:
> Hi all,
>
> I've been reading about what happens after packets are captured by
> NICs, and the more I read, the more I'm confused.

It's waterboarded. If it doesn't confess, it is given a cigarette, a
blindfold, and put in front of a firing squad.

(Sorry, it's late, and I just couldn't resist :-)
From: unruh on 30 Mar 2010 12:23
On 2010-03-30, JimR <NoNotReally(a)notmyemail.com> wrote:
> lancer6238(a)yahoo.com wrote:
>> Hi all,
>>
>> I've been reading about what happens after packets are captured by
>> NICs, and the more I read, the more I'm confused.
>
> It's waterboarded. If it doesn't confess, it is given a cigarette, a
> blindfold, and put in front of a firing squad.
>
> (Sorry, it's late, and I just couldn't resist :-)

The packet is then looked at by the machine, to see if it is for that
machine. If it is, the port number is looked at, and the internal tables
are examined for whether or not the port number is being listened to by
some program. If it is, the packet is handed over to that program for it
to handle it. If not the packet is discarded.


From: Moe Trin on 30 Mar 2010 15:55
On Mon, 29 Mar 2010, in the Usenet newsgroup comp.os.linux.networking, in
article <16274394-fb39-410c-84d8-29ae41d21990(a)k5g2000prg.googlegroups.com>,
lancer6238(a)yahoo.com wrote:

NOTE: Posting from groups.google.com (or some web-forums) dramatically
reduces the chance of your post being seen. Find a real news server.

>I've been reading about what happens after packets are captured by
>NICs, and the more I read, the more I'm confused.

You need to spend a bit of time looking at the physical design of
computers.

>Firstly, I've read that traditionally, after a packet is captured by
>the NIC, it gets copied to a block of memory in the kernel space,
>then to the user space for whatever application that then works on
>the packet data.

OK - reasonable

>Then I read about DMA, where the NIC directly copies the packet into
>memory, bypassing the CPU.

You have to move something - let's say 100 oranges - from a table on
your right to a table on your left. Is it faster to pick up an orange
from the right and put it on the table to your left, OR pick up an
orange from the right, put it on a (tiny) table in front of you, then
pick it up again and move it from the table in front of you to the
table on your left? The table to the right is the NIC - the table in
front of you is the CPU, the table to the left is memory. There may
be several "places" on the table to the left - one area labeled
"Kernel", another labeled "User" but that has nothing to do with the
table in front of you - the CPU.

>So is the NIC -> kernel memory -> User space memory flow still valid?

Yes. Just as nothing happened to the oranges if they were temporarily
put on the table in front of you, nothing happens to the data in the
CPU when it is being used to _move_ from NIC to RAM or from one area
of RAM to another.

>Also, do most NIC (e.g. Myricom) use DMA to improve packet capture
>rates?

For packet _capture_ No. Depending on the design of the NIC and the
design of the driver, it _may_ use DMA for data _transfer_ between the
NIC hardware and the RAM on the motherboard, but that merely relates
to how fast you can shovel stuff from one place to another, not WHERE
it gets shoveled from/to.

Old guy
From: Rick Jones on 30 Mar 2010 16:02
lancer6238(a)yahoo.com <lancer6238(a)yahoo.com> wrote:
> Also, do most NIC (e.g. Myricom) use DMA to improve packet capture
> rates?

Most (virtually all) NICs today use DMA to improve performance across
the board.

> Secondly, does RSS (Receive Side Scaling) work similarly in both
> Windows and Linux systems? I can only find detailed explanations on
> how RSS works in MSDN articles, where they talk about how RSS (and
> MSI-X) works on Windows Server 2008. But the same concept of RSS and
> MSI-X should still apply for linux systems, right?

RSS works similarly in both Linux and Windows systems and can be
considered the "in the NIC" equivalent of the IPS (Inbound Packet
Scheduling) of HP-UX 10.20 from the mid 1990s.

rick jones
--
the road to hell is paved with business decisions...
these opinions are mine, all mine; HP might not want them anyway... :)
feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...
 | 
Pages: 1
Prev: denyhosts
Next: After set master mode can't see essid from other laptop