Re: Scapy performance question

On Tue, 4 Oct 2005, Tony Doan wrote:

> Please note I do the type checking in the scapy script instead of the sniff 
> filter due to an ICMPv6 limitation in pcap (even the newest).

This is the only way to really improve the code, though. Scapy is a bit 
long do disassemble a packet and will do it for every packet sniffed 
arround, and that's why it increases the socket buffer at its max size. In 
your case, if there is some traffic at the same time, it is possible that 
you lost your match when the packet you're supposed to answer is still in 
the buffer. The only way to really improve performance is to filter as 
much as possible wit BPF filters. You said it's borker for IPv6, but you 
still can put the tests on the ethernet header in a BPF, like source 
MAC and 0x86dd for ethertype.

As a side note, as noted by Arnaud, you can try psyco, but you're racing 
against kernel code, on a simple operation, with a host on the same 
network. Even a C program could loose this one.


--
Philippe Biondi <phil@ secdev.org>      SecDev.org
Computer Security/R&D                   http://www.secdev.org
PGP KeyID:3D9A43E2  FingerPrint:C40A772533730E39330DC0985EE8FF5F3D9A43E2

---------------------------------------------------------------------
Desinscription: envoyez un message a: scapy.ml-unsubscribe@xxxxxxxxxx
Pour obtenir de l'aide, ecrivez a: scapy.ml-help@xxxxxxxxxx