Re: [fw-wiz] SCADA



On Tue, 14 Apr 2009, Marcus J. Ranum wrote:

Oddly, plog works faster than regular UDP syslog on some systems,
because the bpf implementations are sometimes faster than the UDP
stack.

I've been doing some testing with rsyslog recently, and with the 4.x development branch I have had it reliably recieve udp messages at as close to gig-e wire speed as a tuned tcpreplay could push them (IIRC it was ~300,000 messages/sec for ~256 byte messages) with no losses (over a fairly quiet network). it can't currently write them from it's memory buffer that fast (only ~80,000 messages/sec sustained), but you can put a lot of memory in a dedicated log server today to handle bursts.

David Lang
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards



Relevant Pages

  • Re: blocking/nonblocking socket and select -> usefull?
    ... The kernel just copies the application data and pass it down to the stack, ... Also, when reading an UDP datagram, there are certain cases on certain ... away inbetween select returning and you calling read. ...
    (comp.unix.programmer)
  • Re: Loosing UDP packets...
    ... The TCP/IP stack can drop UDP datagrams at ANY time, ... buffer space, ...
    (comp.os.linux.networking)
  • Re: ARM Cortex M3 newbie questions
    ... stack, as yet, but they do say they're working on one. ... Biggest problem with network stacks in an embedded system ... Note that UDP doesn't automatically immunize you from these sorts ... more vigilant against attacks ("Gee, ...
    (comp.arch.embedded)
  • [PATCH] sunrpc - fixup user buffer overrun on transports statistics
    ... udp 32768 ... userspace to read. ... With my original program, I found that the stack was ...
    (Linux-Kernel)
  • Re: blocking/nonblocking socket and select -> usefull?
    ... stack, prepending the UDP and IP headers. ... Some stacks implement intra-stack flow control for udp so there can be ... recv the datagram that isn't there on a blocking socket will block you ... code that compiles under more than one compiler ...
    (comp.unix.programmer)