Linux Socket Filter sudden CPU use increase

Linux Socket Filter sudden CPU use increase

Post by Eduardo Maga?a Lizarrond » Thu, 01 Mar 2001 05:50:04

I have been testing Linux Socket Filters (LSF) these weeks (kernels
2.2.14, 2.2.18, 2.4.1) with libpcap (0.4 - 0.6.2) and I have observed
something curious. I make a program that increase number of simultaneous
LSF filters (5, 10, 15..) and when this number is between 15 and 50,
CPU consumed by kernel increases suddenly. Any idea?
(you can see a figure of CPU vs. number of LSF filter in

I do not see anything stranger. Only, using Linux Trace Toolkit with
modifications when there are few filters, I observe that of timer Bottom
follows IRQ 0. And when there are more filters, IRQ 0 takes place when
network Bottom Half is taking place, so the timer Bottom Half is delayed
the end of the network Bottom Half. Can it be related?

To measure kernel CPU I have used the trick of running another CPU with
priority. According to the time this second process is delayed an
%CPU is obtained.

I do not understand what is happening. Any help would be very useful.


Eduardo Maga?a Lizarrondo
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in

More majordomo info at
Please read the FAQ at


1. apache 1.1 sudden CPU usage increases

I am trying to switch to Apache 1.1 from NCSA 1.5.  I have tremendous
problems because after 5-10 minutes the CPU usage goes off the scale
and I am forced to restart the server(s).  Any idea why apache
does this, and how I can prevent it?

My error log is also frequently populated with lines that say:

accept: Protocol error
- socket error: accept failed

What can cause an accept protocol error?


David Michaels

2. ADVFS multipathing

3. increase mem -> increase cpu performance ?

4. Anyone get NNTP to work?

5. CPU temperature increase when using USB

6. Tropez plus

7. sudden increase in paging utilization

8. errors in /var/log/messages

9. IIS -> Apache: Sudden increase in number of hits!

10. listening socket using too much CPU?

11. sudden change - ppp is now burning cpu via klog/syslog

12. mail filtering problem using elm filter

13. Sudden lockups when overloading a socket?