over 98% packet loss when large network traffic

[imroc]

Is it because of cgo's performance? the speed can not catch up with libpcap, its' buffer is full, then throw the packets away?

[lhausermann]

hi @imroc
libpcap has its pitfalls with large network traffic. It's not really related to cgo based on my understanding but on lowel level packet manipulation.

Did you tried other sockets like AF_PACKET or PF_RING which are also supported by gopacket ?

By the way, @gconnell has also published a stack for high performance packet capture : https://github.com/gconnell/stenographer

Cheers
Laurent

[imroc]

hi @lhausermann , thanks for answing me. I tried PF_RING, it got almost the same result. In my mind, cgo calling's performance is a issue, in large network traffic, the calling frequency should be very very high, I strongly believe that cgo will cause packets loss in some degree. I thought using c directly will be better in large network traffic

[gconnell]

Hey, @imroc,

A quick note: AF_PACKET doesn't do cgo calls for every packet (in fact, I believe it only does cgo calls during setup), so it should get around any cgo-related performance issues you're facing.

[imroc]

@gconnell thank you, I'll try it later 😊