Endace DAG 5.2X, Руководство пользователя

Страница: 37 / 66

EDM01-33v1 DAG_7.5G4_Card_User_Guide
©2008 Endace Technology Ltd. Confidential - Version 1 - November 2008 33
Capturing data at high speed
As the DAG 7.5G4 card captures packets from the network link, it writes a record for each
packet into a large buffer in the host computer’s main memory.
To avoid packet loss, the user application reading the record, such as
dagsnap
, must be able to
read records out of the buffer as fast or faster than they arrive. If not the buffer will
eventually fill and packet records will be lost.
If the user process is writing records to hard disk, it may be necessary to use a faster disk or
disk array. If records are being processed in real-time, a faster host CPU may be required.
In Linux and Free BSD, when the computer buffer fills, the following message displays on
the computer screen:
kernel: dagN: pbm safety net reached 0xNNNNNNNN
The same message is also printed to log
/var/log/messages
file. In addition, when the
computer buffer fills the “Data Capture” LED on the card will flash or flicker, or may go OFF
completely.
In Windows no screen message displays to indicate when the buffer is full. Please contact
Endace Customer Support at support@endace.com
Detecting Packet Losses
for further information on detecting
buffer overflow and packet loss in Windows.
Once the buffer fills, any new packets arriving will be discarded by the DAG 7.5G4 card until
some data is read out of the buffer to create free space.
You can detect any such losses by observing the Loss Counter
(lctr
field) of the Extensible
Record Format (ERF). See Data Formats 53 (page ) later in this User Guide for more
information on the Endace ERF record format.
Increasing Buffer Size
You can increase the size of the host computer buffer to enable it to cope with bursts of high
traffic load on the network link.
For information on increasing the buffer size, see
buffer_size 22 (page ).