Tpacket v3 10 #2036
Closed
Tpacket v3 10 #2036
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
No need for cooked header in the case of mmap capture.
This patch adds a basic implementation of AF_PACKET tpacket v3. It is basic in the way it is only working for 'workers' runnning mode. If not in 'workers' mode there is a fallback to tpacket_v2. Feature is activated via tpacket-v3 option in the af-packet section of Suricata YAML.
Reorder fields in AFPThreadVars and suppress some that were not used elsewhere than in the initialization.
Suppress useless fields in AFPThreadVars. This patch also get rid of bytes counter as it was only used to display a message at exit. Information on livedev and on packet counters are enough.
Error handling was not done. The implementation is making the choice to consider we must detroy the socket in case of parsing error. The same was done for tpacket_v2.
It is used to set the block size in tpacket_v3. It will allow user to tune the capture depending on his bandwidth. Default block size value has been updated to a bigger value to allow more efficient wlak on block.
Block timeout defines the maximum filling duration of a block.
If TPACKET_V3 is not defined then it is not available and we should not build anything related to tpacket_v3. This will allow us to activate it dy default and fallback to v2 if not available.
Update the code to use mmap capture by default even in unset in configuration file. mmap capture is now be turned off by using explicitely 'use-mmap: no' in configuration.
We can loose packets during setup because we are reading nothing. So it is logical to discard the counter at start of capture to start from a clean state. This means we don't need to account the drop at start. But the stats call that will reset the drop counts will also return and reset the packets count. So we need to know how many packets we really have. This is in fact the number of packets coming from the stats call minus the number of discarded packets and the drop count. All the other packets will have to be read.
Only parse them if mmap is activated.
As we only use the second we don't need GetTime() which is slower and get us milliseconds.
| ptv->req3.tp_frame_size); | ||
| return -1; | ||
| } | ||
| ptv->req3.tp_block_nr = ptv->ring_size / frames_per_block + 1; |
There was a problem hiding this comment.
why is block_nr (which I interpret as: the number of blocks of size 'ptv->block_size') not calculated as ring_size / block_size?
There was a problem hiding this comment.
ring_size is in number of elements not in bytes. So we divide by number of frame per block to get number of elements. This is for sure making less sense in v3 than in v2.
|
Closing and resubmitting with rebase and a little fix. |
Closed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Rework of #2032.
Modifications:
PR builds: