Capture packets at 10g interface
Hi All, I have to write a kernel module in which I have to capture packets from 10g nic interface and make a copy of them. I have two options Either use netfilters Either use add dev pack If any options u thing please let me know. Should the module be multi threaded? As I can't compromise with performance. Can I bind kernel threads to specific core? Regards
On Thu, Jan 28, 2016 at 11:47:36PM +0530, Tarun Batra wrote:
Hi All,
I have to write a kernel module in which I have to capture packets from 10g nic interface and make a copy of them.
Why do you want to do that?
I have two options Either use netfilters Either use add dev pack
What do you mean by this last choice?
If any options u thing please let me know.
Should the module be multi threaded?
Why would it be?
As I can't compromise with performance.
Can I bind kernel threads to specific core?
Yes, but are you sure you really want to do this in the kernel? Can't you do this today already from userspace? thanks, greg k-h
I want to do that because I have to write a packet inspection module sort of idps solution. We are targeting kernel space because of performance. On Jan 29, 2016 12:09 AM, "Greg KH" <greg@kroah.com> wrote:
On Thu, Jan 28, 2016 at 11:47:36PM +0530, Tarun Batra wrote:
Hi All,
I have to write a kernel module in which I have to capture packets from 10g nic interface and make a copy of them.
Why do you want to do that?
I have two options Either use netfilters Either use add dev pack
What do you mean by this last choice?
If any options u thing please let me know.
Should the module be multi threaded?
Why would it be?
As I can't compromise with performance.
Can I bind kernel threads to specific core?
Yes, but are you sure you really want to do this in the kernel? Can't you do this today already from userspace?
thanks,
greg k-h
On Fri, Jan 29, 2016 at 12:14:20AM +0530, Tarun Batra wrote:
I want to do that because I have to write a packet inspection module sort of idps solution.
What is forcing you to do such a thing? Is this for a homework assignment, or are you trying to create a product?
We are targeting kernel space because of performance.
How do you know that putting this in the kernel will be faster? Do you have measurements that show this? Is doing this today somehow too slow using the existing interfaces that allow you to do this? thanks, greg k-h
We are trying to build product and as per decisions of senior we need to capture packets in kernel On Jan 29, 2016 1:01 AM, "Greg KH" <greg@kroah.com> wrote:
On Fri, Jan 29, 2016 at 12:14:20AM +0530, Tarun Batra wrote:
I want to do that because I have to write a packet inspection module sort of idps solution.
What is forcing you to do such a thing? Is this for a homework assignment, or are you trying to create a product?
We are targeting kernel space because of performance.
How do you know that putting this in the kernel will be faster? Do you have measurements that show this? Is doing this today somehow too slow using the existing interfaces that allow you to do this?
thanks,
greg k-h
@OP, Seems a bit overkill but due to a similar project please keep me updated please Corey W Sheldon ph: +1 (310).909.7672 Freelance IT Consultant, Multi-Discipline Tutor csheldon@ameridea.net corey84@fedoraproject.org linuxmodder@keybase.io Ameridea LLC, Founder, CTO Fedora Ambassador, North America Server Team Intern, City-Gate https://github.com/ameridea https://getfedora.org https://city-gate.org Find me elsewhere: https://gist.github.com/linux-modder/ac5dc6fa211315c633c9 PGP: 0xCe2ad4c03a9eff1c FP= ba7e aeba 7c64 1eca f4b9 70a8 ce2a d4c0 3a9e ff1c PGP: 0x76ef54b9aed032e2 FP= 984e 1693 de66 2109 596c 0930 76ef 54b9 aed0 32e2 Tox: corey84@toxme.io | 9357bc6a5944a08afc7d1effd61f6a73b9eabf8b2fb84acf1dac9a1a4d0a4705ffccd0e5499b Linphone: sip:linuxmodder BitAddress:15cn1BvAFEREHk8UekJ6i9Dxi9Wbw6vzDD "Have no way as way, no limitation as limitation. One must never underestimate the power of boredom...from which creativity and laziness are borne, which can spark great works of chaos and genius." This document, including attachments, is intended for the person or company named and contains confidential and/or legally privileged information. Unauthorized disclosure, copying or use of this information may be unlawful and is prohibited. If you are not the intended recipient, please destroy this message and notify the sender. On Fri, Jan 29, 2016 at 9:07 AM, Tarun Batra <tbatra18@gmail.com> wrote:
We are trying to build product and as per decisions of senior we need to capture packets in kernel On Jan 29, 2016 1:01 AM, "Greg KH" <greg@kroah.com> wrote:
On Fri, Jan 29, 2016 at 12:14:20AM +0530, Tarun Batra wrote:
I want to do that because I have to write a packet inspection module sort of idps solution.
What is forcing you to do such a thing? Is this for a homework assignment, or are you trying to create a product?
We are targeting kernel space because of performance.
How do you know that putting this in the kernel will be faster? Do you have measurements that show this? Is doing this today somehow too slow using the existing interfaces that allow you to do this?
thanks,
greg k-h
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
On Fri, Jan 29, 2016 at 07:37:57PM +0530, Tarun Batra wrote: We are trying to build product and as per decisions of senior we need to capture packets in kernel
My understanding is 10G interfaces push traffic directly into userspace- the kernel is not involved at all here. Cheers, Daniel
Then I suggest you ask senior how to do this :)
Best of luck,
greg k-h
_______________________________________________ Kernelnewbies mailing list Kernelnewbies@kernelnewbies.org http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
On Sat, Jan 30, 2016 at 12:19:28PM +1100, Daniel Ng wrote:
On Fri, Jan 29, 2016 at 07:37:57PM +0530, Tarun Batra wrote: We are trying to build product and as per decisions of senior we need to capture packets in kernel
My understanding is 10G interfaces push traffic directly into userspace- the kernel is not involved at all here.
Some implementations do, some do not, it depends on the hardware and the setup the user has created for this. But to expect people on kernelnewbies to design a product implementation for someone is a bit of a streach for this group :) thanks, greg k-h
On Saturday 30 January 2016, Daniel Ng <daniel.ng1234@gmail.com> wrote:
On Fri, Jan 29, 2016 at 07:37:57PM +0530, Tarun Batra wrote: We are trying to build product and as per decisions of senior we need to capture packets in kernel
My understanding is 10G interfaces push traffic directly into userspace- the kernel is not involved at all here.
depends, if you are doing kernel bypass then yes e.g dpdk and friends, otherwise probably not. --- thanks anupam -- In the beginning was the lambda, and the lambda was with Emacs, and Emacs was the lambda.
participants (5)
-
Anupam Kapoor -
Corey Sheldon -
Daniel Ng -
Greg KH -
Tarun Batra