memory mapped packet capturing - bpf replacement ?

[Sergey Lyubka]

> Does the ng_hub cause the packet to be copied?  If so you've 
> still got the same number of copies as vanilla BPF.

ng_hub does copy a packets. But, this does not explain the test results.
the benchmark works like this:

1. connect ng_mmq node to ng_hub
2. run benchmark for mmq
3. open pcap device   (mmq node still connected)
4. run benchmark for pcap (mmq node still connected)

so, ng_mmq and ng_hub are working during pcap benchmark, so additional
copies do not explain it.

the strange thing is:
why bpf, which does context switches, works more efficiently than
grabbing packets directly from memory mapped chunk ?

did I overlook something significant ?

I was thinking that while application spins awaiting data, scheduler may
detach it from the CPU, and then ringbuffer may be overflown.
I increased the priority to ridiculous values, and increased ringbuffer size
to as large as 32 Megabytes. The best I got is the same results as pcap.
Can anybody explain this ?

Example test, moderate traffic generated by the ping -f:
# ./benchmark rl0 /dev/mmq16 10000
desc  rcvd       dropped    seen       totlen     pps        time (sec)
mmq   10784      770        10000      13420000   10076      1.070  
pcap  10016      0          10000      13420000   9093       1.102