我在项目中使用libpcap并使用函数pcap_set_buffer_size()来设置初始值。当环形缓冲区已满时，libpacp 统计数据显示大量数据包被丢弃。
如何获取有关环形缓冲区可用空间的信息？
最佳答案
来自 man pcap :
a size that's too small could mean that, if too many packets are being captured and the snapshot length doesn't limit the amount of data that's buffered, packets could be dropped if the buffer fills up before the application can read packets from it, while a size that's too large could use more non- pageable operating system memory than is necessary to prevent packets from being dropped
缓冲区的理想大小取决于用例。
您可以通过使用二分法来找到这个理想的尺寸:
- 首先设置一个巨大但系统支持的大小
- 使用 pcap_stats() 获取丢弃的数据包数量
- 再次编译并运行。
请注意是否丢失了数据包。
然后设置为当前尺寸
- 使用 pcap_stats() 获取丢弃的数据包数量
- 再次编译并运行。
请注意是否丢失了数据包。
然后将大小设置为(大尺寸 + 当前尺寸)/2
- 使用 pcap_stats() 获取丢弃的数据包数量
- 再次编译并运行。
请注意是否丢失了数据包。
...
请注意，您可以通过使用 pcap_set_snaplen() 设置快照长度来减少缓冲区使用量
If, when capturing, you capture the entire contents of the packet, that requires more CPU time to copy the packet to your application, more disk and possibly network bandwidth to write the packet data to a file, and more disk space to save the packet. If you don't need the entire contents of the packet - for example, if you are only interested in the TCP headers of packets - you can set the "snapshot length" for the capture to an appropriate value. If the snapshot length is set to snaplen, and snaplen is less than the size of a packet that is captured, only the first snaplen bytes of that packet will be captured and provided as packet data
您可以使用shotpcap_snapshot()获取当前的snaplen
关于c++ - 如何得知 libpcap 的环形缓冲区是否已满，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/57285445/