Scapy Packet Capture Performance Testing Report

1. Title: Scapy Packet Capture Performance Testing Report

2. Abstract

This report presents the results of testing the Scapy library for packet capture. The objective was to
determine the traffic rates at which packet loss occurs and assess if Scapy is suitable for our IP link
analyzer project. Tests were conducted on the loopback (lo) interface using various traffic rates and
durations with iperf3. We recorded packet capture counts, CPU usage, memory usage, and packet
loss percentages.

3. Introduction

The purpose of this testing was to evaluate the performance of the Scapy library in capturing network
packets under different conditions. The focus was on measuring packet loss, CPU usage, and
memory consumption at various traffic rates, durations, and numbers of packets. The results will help
determine if Scapy is suitable for our core packet capture script.

4. Methodology and Testing Environment Set-Up

Environment Setup:

Operating System: Ubuntu 20.0.4 (Linux)

Interface: Loopback (lo)
Packet Capture Library: Scapy 2.11.2
Function: sniff
Traffic Generation Tool: iperf3 3.16
Monitoring Tools: Wireshark 4.2.5 (for verification), top (for CPU and memory usage)

Tools and Libraries Used:

Scapy: For packet capture.

iperf3: For generating traffic at various rates.
Wireshark: For verifying captured packets.
top: For monitoring CPU and memory usage.

Detailed Test Setup

GitHub Repository for Core Packet Capture Experiments

Preliminary Steps:

1. Stop Network Manager: Ensure the Network Manager is stopped to avoid any unnecessary
DNS packets and get more accurate readings.

sudo systemctl stop NetworkManager

2. Disable Unnecessary Plugins: If using an IDE like VSCode, disable any unnecessary plugins
that might generate additional network traffic.

Setup the Loopback Interface for Packet Capture Using Scapy:

1. Install Scapy:

pip install scapy

2. Capture Script: Use the provided capture script from the GitHub repository:
core_packet_capture.py
3. Run the Script: Execute the script to start capturing packets on the loopback interface.

sudo python3 core_packet_capture.py

Use iperf3 to Generate Traffic at Different Rates and Durations:

1. Install iperf3:

sudo apt-get install iperf3

2. Start iperf3 Server:

iperf3 -s

3. Generate Traffic:
For Specific Bandwidth and Duration:

iperf3 -c 127.0.0.1 -u -b [bandwidth] -t [duration]

[bandwidth] : Target bandwidth (e.g., 1G for 1 Gbps).

[duration] : Test duration in seconds (e.g., 1000 ).
 For Specific Bandwidth and Number of Packets:

iperf3 -c 127.0.0.1 -u -b [bandwidth] -n [number_of_packets] -l

[packet_length]

[bandwidth] : Target bandwidth (e.g., 10M for 10 Mbps).

[number_of_packets] : Number of bytes to transmit (e.g., for 1000 packets use
1460000 ).
[packet_length] : Length of each packet in bytes (e.g., 1460 ).

Capture Packets Using Scapy and Verify with Wireshark:

1. Capture Packets with Scapy: Run the Scapy capture script while generating traffic with iperf3.
2. Open Wireshark: Launch Wireshark and start capturing on the loopback interface ( lo ).
3. Verify Captured Packets: Compare the packets captured by Scapy with those captured by
Wireshark to ensure consistency.

Record CPU Usage, Memory Consumption, and Packet Loss Percentage:

1. Monitor CPU and Memory Usage:

top

2. Record Packet Loss: Analyze the captured packets to calculate the packet loss percentage by
comparing the number of packets sent with the number of packets received.

5. Results

Total Memory Available: 15674.1 MiB

Packets Captured at Different Durations with Varying Rates :

Rate Duration packets packets packets packet loss% cpu% cpu% memory memory
captured captured lost user system used free
(scapy) (wireshark) (mib) (mib)

1K 10 66 33 0 0 1.3 0.3 1934.1 10555

1K 30 66 33 0 0 1.3 0.4 1901.6 10437.9
1K 60 66 33 0 0 0.4 0.1 1924 10436.8
1K 100 66 33 0 0 1.2 0.4 1943.9 10381.2
1K 300 84 42 0 0 0.4 0.1 1940 10406.4

1K 1000 282 141 0 0 0.3 0.3 1952.8 10393.9

1K 1800 528 264 0 0 0.2 0.1 1954.7 10412.7
10K 10 66 33 0 0 0.2 0.3 1985.5 10360.8
10K 30 68 34 0 0 1 0.4 1935.4 10384

10K 60 70 35 0 0 0.2 0.1 1982.9 10374.2

10K 100 72 36 0 0 0.3 0.2 1980.4 10358.8
10K 300 106 53 0 0 0.5 0.2 1985.2 10364.8
10K 1000 558 279 0 0 2.2 0.7 1940.4 10351.8
10K 1800 650 325 0 0 0.3 0.3 2002.7 10298.5

100K 10 72 36 0 0 0.8 0.4 1876.9 10412.1

100K 30 88 44 0 0 0.7 0.3 1898.5 10389.2
100K 60 110 55 0 0 2.9 0.1 1853.9 10411.8
100K 100 142 71 0 0 0.4 0.2 1903.3 10402.8
100K 300 342 171 0 0 1.7 0.6 1903.7 10352.6
100K 1000 836 418 0 0 1.1 0.4 1558.4 12254.1
1M 10 142 71 0 0 0.7 0.3 1578.5 12270.6
1M 30 294 147 0 0 0.4 0.4 1567.7 12284.9
1M 60 522 261 0 0 0.4 0.1 1567.1 12294.1
1M 100 828 414 0 0 0.5 0.3 1573.8 12276.1
1M 300 2354 1177 0 0 0.7 0.3 1575.4 12223
1M 1000 7708 3854 0 0 0.6 0.3 1597.1 12123.8
10M 10 828 414 0 0 1.6 0.6 1567.4 12263.8
10M 30 2354 1177 0 0 0.1 0.2 1564.7 12263.9
10M 60 4642 2321 0 0 1.7 0.4 1534.1 13674.1
10M 100 7702 3851 0 0 1.2 0.4 1572.3 12167.6
10M 300 22954 11477 0 0 2 0.3 1564.1 11923.7
10M 1000 76552 38276 0 0 0.6 0.2 2198.3 9402
100M 10 7694 3847 0 0 0.6 0.4 1943.8 11181
100M 30 22944 11476 4 0.0348553503 1.9 0.5 1502.6 12019.3
100M 60 45834 22921 4 0.01745124558 0.8 0.3 1467.7 11637.5
100M 100 76348 38179 5 0.01309620472 0.8 0.5 1546.8 11087

100M 300 228925 114474 11.5 0.0100459493 3.4 0.3 1550 8623.3
100M 1000 762885 381551 108.5 0.02843656549 2.8 0.4 2225.8 151.2
1G 10 48457 38079 13850.5 36.37306652 2 0.9 2011.3 9108.3
1G 30 143702 114387 42536 37.18604387 4 0.7 2346.5 7263.8
1G 60 289138 228710 84141 36.78938394 8.2 1.4 2290.3 3640

1G 100 483967 381189 139205.5 36.51876103 0.3 1 2356.2 164.3

1G 300 1339519 1144036 474276.5 41.45643144 3.8 0.6 2296.5 174.5
1G 1000 4283476 3089569 947831 30.67842149 4.8 0.8 2753.8 158.4
 Packets Captured for Different Number of packets Sent at Varying Rates

Rate packets packet packet packets packet cpu% cpu% memory memory
sent captured captured lost loss % user system used free
(scapy) (wireshark) (mib) (mib)
1K 10 84 42 0 0 1.7 0.5 1786.6 11084.3
1K 100 264 132 0 0 1.1 0.4 1791.4 11093.4
10K 10 84 42 0 0 0.4 0.3 1753.8 11126.2

10K 100 280 140 0 0 1.5 0.4 1789.3 11057.9

10K 1000 2064 1032 0 0 1.3 0.4 1806.4 11047.4
100K 10 86 43 0 0 0.4 0.4 1812.7 11033.5
100K 100 264 132 0 0 1.1 0.3 1806.2 11033
100K 1000 2066 1033 0 0 1.3 0.5 1775.2 11074
100K 10000 20064 10032 0 0 1.5 0.5 1798.4 11068.4
1M 10 86 43 0 0 1 0.4 1808.6 11029.7
1M 100 280 140 0 0 1.1 0.4 1801.7 11035.5
1M 1000 2064 1032 0 0 1 0.4 1802.4 11046
1M 10000 20080 10040 0 0 1.3 0.4 1810.1 11024.6
1M 100000 200064 100032 0 0 1.8 0.6 1823.6 11045.5

10M 10 82 41 0 0 0.8 0.3 1846.4 10982.2

10M 100 264 132 0 0 0.9 0.6 1837 10986.1
10M 1000 2064 1032 0 0 2.1 0.9 1840.8 11006.9
10M 10000 20064 10032 0 0 1.1 0.3 1811.8 11020.7
10M 100000 200064 100032 0 0 1.6 0.8 1795 10877.3
10M 1000000 2000130 1000065 0 0 1.9 0.6 2154.3 9146.5
100M 10 82 41 0 0 0.9 0.4 1847.2 10979.4
100M 100 159 131 51.5 39.3129771 0.7 0.3 1832.7 10980.2
100M 1000 892 1032 586 56.78294574 0.8 0.3 1854.7 10983.2
100M 10000 8051 10040 6014.5 59.90537849 0.4 0.3 1851.9 10967.8
100M 100000 79142 100032 60461 60.44165867 0.4 0.3 1862.6 10821.8

100M 1000000 800323 1000040 599878.5 59.98545058 1.5 0.4 2120.4 9212.2
1G 10 82 41 0 0 1 0.4 2130.7 10684.8
1G 100 113 131 74.5 56.87022901 0.6 0.3 2137.9 10701.9
1G 1000 204 1039 937 90.18286814 0.6 0.3 2143 10695.2
1G 10000 780 10032 9642 96.11244019 0.7 0.3 2133.4 10688.7

1G 100000 8049 100032 96007.5 95.97678743 5.6 3.8 2121 10560

1G 1000000 80006 1000032 960029 95.99982801 0.5 0.4 2141.5 9190.4
Graphs:
Graphs illustrating packet capture rates, CPU usage, and memory consumption for different test
cases

Duration-Based Tests

Packet Loss% Charts

Number of Packets Lost Based Charts
CPU% Usage Charts
Memory-Usage Charts
Packet-Based Tests
Packet Loss% Charts
Number of Packets Lost Based Charts
6. Discussion

Analysis of Results:

Duration-Based Tests:
At low traffic rates (up to 10Mbps), Scapy performs well with negligible packet loss.
Significant packet loss starts at 100Mbps, becoming critical at 1Gbps.
CPU usage remains low across most tests, but spikes significantly at higher traffic rates and
durations.
Memory consumption also spikes significantly at higher traffic rates and durations.
Packet-Based Tests:
Similar trends are observed with low to moderate traffic rates showing minimal packet loss.
High traffic rates (100Mbps and above) exhibit substantial packet loss, particularly with large
numbers of packets.
CPU and memory usage patterns are consistent with those observed in duration-based
tests.

Comparison with Expected Outcomes:

 Scapy meets expectations for low to moderate traffic rates but struggles with high traffic rates
(100Mbps and above).
The packet loss at high rates indicates potential limitations in Scapy’s packet handling
capabilities.

7. Conclusion

Summary of Findings:

Scapy is suitable for low to moderate traffic rates, with minimal packet loss and stable resource
usage.
For high traffic rates (100Mbps and above), Scapy experiences significant packet loss, which
may impact the project's performance requirements.

Final Verdict on Scapy’s Suitability:

Scapy can be used for packet capture in environments with traffic rates up to 10Mbps. For our IP
link analyzer project, alternative solutions should be considered to avoid packet loss issues.