netlink multi-thread / libmnl / nfq

netlink multi-thread / libmnl / nfq

[Ryan Johnston]

Hi,

When creating a multi-threaded NFQ/Netlink application, should I have
multiple threads with fd sockets connected to the kernel, or do I have
one socket with multiple thread loops to read the socket?

If I am to have many threaded fd sockets connected to kernel's
netlink, is there any performance loss by having too many?

Re: netlink multi-thread / libmnl / nfq

[Florian Westphal]

Ryan Johnston <ryan@mediapixel.co.nz> wrote:
> When creating a multi-threaded NFQ/Netlink application, should I have
> multiple threads with fd sockets connected to the kernel, or do I have
> one socket with multiple thread loops to read the socket?

Its up to you.

> If I am to have many threaded fd sockets connected to kernel's
> netlink, is there any performance loss by having too many?

For best performance use multiple queues, e.g. manually via iptables
-m cpu ...  -j NFQUEUE, or via iptables .. NFQUEUE --queue-balance 0:x,
then run one process or thread for each queue.

One thread per queue model is implemented in suricata ids for example.

Re: netlink multi-thread / libmnl / nfq

[Ryan Johnston]

Yes with --queue-balance do I open a socket via nfq_open() per thread
or do I just have the one nfq_open() and have each thread call
nfq_create_queue only?

On Wed, Jun 3, 2015 at 9:22 AM, Florian Westphal <fw@strlen.de> wrote:
> Ryan Johnston <ryan@mediapixel.co.nz> wrote:
>> When creating a multi-threaded NFQ/Netlink application, should I have
>> multiple threads with fd sockets connected to the kernel, or do I have
>> one socket with multiple thread loops to read the socket?
>
> Its up to you.
>
>> If I am to have many threaded fd sockets connected to kernel's
>> netlink, is there any performance loss by having too many?
>
> For best performance use multiple queues, e.g. manually via iptables
> -m cpu ...  -j NFQUEUE, or via iptables .. NFQUEUE --queue-balance 0:x,
> then run one process or thread for each queue.
>
> One thread per queue model is implemented in suricata ids for example.

Re: netlink multi-thread / libmnl / nfq

[Florian Westphal]

Ryan Johnston <ryan@mediapixel.co.nz> wrote:
> Yes with --queue-balance do I open a socket via nfq_open() per thread
> or do I just have the one nfq_open() and have each thread call
> nfq_create_queue only?

Apparently both is possible (I had to look it up :-/)
but i'd suggest to have one fd per queue, i.e. nfq_open() per thread.

Re: netlink multi-thread / libmnl / nfq

[Ryan Johnston]

Okay, is there any performance loss by havin more sockets connected to
the kernel? Or does --queue-balance just rotate each packet to each
socket/thread?

On Wed, Jun 3, 2015 at 10:23 AM, Florian Westphal <fw@strlen.de> wrote:
> Ryan Johnston <ryan@mediapixel.co.nz> wrote:
>> Yes with --queue-balance do I open a socket via nfq_open() per thread
>> or do I just have the one nfq_open() and have each thread call
>> nfq_create_queue only?
>
> Apparently both is possible (I had to look it up :-/)
> but i'd suggest to have one fd per queue, i.e. nfq_open() per thread.