libpcap：接收帧和调用回调函数之间的延迟

Question

i am experiencing the following situation: I open with pcap_open_live() one of my network-interfaces. Then i am compiling a filter for pcap for only capturing a specified ethernet-type (ether proto 0x1234). Now i am starting the pcap_loop(). The only thing, that the callback-function executes, is to send a frame via pcap_inject(). (The frame is hard-coded as a global char array).

When i compare now the timestamps of the received and the sent frame (e.g. on wireshark on a third non-involved computer) the delay is around 3 milliseconds (minumum 1 millisecond, but also up to 10 milliseconds). So pcap needs in average around 3 milliseconds to proceed with the received frame and calling the callback-function for sending the new frame. I want/have to decrease that delay.

Following things i already tried:

• tried all different variants of read-timout (in ms) in pcap_open_live(): even a read-timout of -1, which should be to my knowledge a polling, generates a delay of around 3 milliseconds
• setting no filter
• setting a higher priority to process
• set InterrupThrottleRate=0 and other parameters of the e1000/e1000e-kernel module to force the hardware sending an interrupt for every single frame

But i never decreased the delay under the average of 3 milliseconds.

对于我计划的应用程序，有必要在100 微秒以内的时间内对传入数据包做出反应。这通常可以用 libpcap 实现吗？！或者对于实现这样的应用还有其他建议吗？

感谢大家的回复，我希望任何人都可以帮助我！

注意：我正在 Linux/Ubuntu 下使用 C/C++ 进行部署。

Answer 1

对于我计划的应用程序，有必要在100 微秒以内的时间内对传入数据包做出反应。

然后，libpcap 运行时的许多捕获机制（AIX 上的 BPF、Linux 上较新的 libpcap 和内核的 TPACKET_V3、Solaris 10 及更早版本上的 DLPI 等）提供的缓冲，以减少每个数据包的开销。你的方式。

如果您系统上的 libpcap 有该pcap_set_immediate_mode()功能，则：

• 使用pcap_create()和来打开捕获设备，pcap_activate()而不是使用 ；pcap_open_live()
• 和pcap_set_immediate_mode()之间调用。pcap_create()pcap_activate()

在“立即模式”下，捕获机制一接收到数据包就应立即将其传送给应用程序。