[netflow-tools] softflowctl expire-all

[Damien Miller]

Robin Breathe wrote:
> Damien Miller wrote:
> 
>>>I've managed to replicate the problem running with a stock installation
>>>of softflowd/flowd from ports under FreeBSD 6.0-BETA5.
>>
>>Yes, I have replicated it too. It looks like flowd can lose packets when
>>they come in large sudden bursts. I'm adding an input buffer and
>>changing the processing order to better cope with these situations.
> 
> 
> Excellent! Let me know when it's ready to test :)

Here it is.

The attached patch adds an input queue to flowd. When a listening fd
becomes ready (i.e. flow data is received), flowd will read and enqueue
up to 1024 packets before processing them.

It won't stop situations where flowd simply can't keep up with the data
coming at it (my laptop for example drops after ~1k flows per second),
but it should help it deal better with sudden bursts of flows.

I'll tweak this a bit further, I think it could be made a little faster
by replacing the allocations of queued packets with a freelist of
preallocated ones. It would probably be better to maintain an output
queue as well, instead of doing one write per flow.

This is against flowd -current, so if you aren't already using a
snapshot, then you will need to get one from:

http://www2.mindrot.org/flowd_snap/

-d

-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: flowd-input-buffer.diff
Url: http://lists.mindrot.org/pipermail/netflow-tools/attachments/20050927/0f50cf41/attachment.ksh