Hi,
I am developing a sniffer for gigabit networks.
I am using a dual-processor Xeon(2 Ghz) machine and
Intel PRO/1000 gigabit NIC adapter running linux
2.4.20-8 smp.
I thought I can receive 1 Gbps traffic and
sniff using a raw socket. But with an average packet
size of around 400 bytes I am not able to receive
anything more than 500 Mbps. Also all packets received
at the interface are not received by raw socket (Drops
at driver and other kernel buffers).
Now I want to use a machine as router that can
receive 1 Gbps traffic, split it and send it to 3
different machines so that they can handle it. But I
will face the same problem in building that router
also.
Can somebody suggest any tool or link that will
be of some use for me. Can I use LRP or Click to solve
my problem. I tried changing settings like netdev_max_backlog,
rmem_max and wmem_max to bigger values but of no use.

Thanks in advance
Srikanth