Trying to understand max-pending-packets

According to the max-pending-packets doc:

This setting controls the number simultaneous packets that the engine can handle. 
Setting this higher generally keeps the threads more busy, but setting it too high will lead to degradation.
Suggested setting: 10000 or higher. Max is ~65000. This setting is per thread. 

But I’m not sure how to make sense of this.
From the code, that value defines how big of a packet pool there is per thread… but how does a thread consume that may packets at once?
It seems like (looking through source-af-packet) that packets are read from the socket, wrapped in a packet* struct, and then processed.

My current setup has this value set to 2048, and I’m trying to figure out how bad that actually is (the docs suggest 10000+ so my config is definitely low!).

Additionally, in AFPParsePacketV3(), if the packet pool is empty, then the code will allocate a new one anyway, so it seems like the doc technically isn’t true, either, as the number of in-parallel-allocated packets is not bound to the size of the pool.

Any help/insight here would be greatly appreciated!


1 Like