Capture packets at 10g interface

Capture packets at 10g interface

[Tarun Batra]

Hi All,

I have to write a kernel module in which I have to capture packets from 10g
nic interface and make a copy of them.
I have two options
Either use netfilters
Either use add dev pack
If any options u thing please let me know.

Should the module be multi threaded?
As I can't compromise with performance.

Can I bind kernel threads to specific core?

Regards
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20160128/64872c64/attachment.html 

Capture packets at 10g interface

[Greg KH]

On Thu, Jan 28, 2016 at 11:47:36PM +0530, Tarun Batra wrote:
> Hi All,
> 
> I have to write a kernel module in which I have to capture packets from 10g nic
> interface and make a copy of them.

Why do you want to do that?

> I have two options
> Either use netfilters
> Either use add dev pack

What do you mean by this last choice?

> If any options u thing please let me know.
> 
> Should the module be multi threaded?

Why would it be?

> As I can't compromise with performance.
> 
> Can I bind kernel threads to specific core?

Yes, but are you sure you really want to do this in the kernel?  Can't
you do this today already from userspace?

thanks,

greg k-h

Capture packets at 10g interface

[Tarun Batra]

I want to do that because I have to write a packet inspection module sort
of idps solution.
We are targeting kernel space because of performance.
On Jan 29, 2016 12:09 AM, "Greg KH" <greg@kroah.com> wrote:

> On Thu, Jan 28, 2016 at 11:47:36PM +0530, Tarun Batra wrote:
> > Hi All,
> >
> > I have to write a kernel module in which I have to capture packets from
> 10g nic
> > interface and make a copy of them.
>
> Why do you want to do that?
>
> > I have two options
> > Either use netfilters
> > Either use add dev pack
>
> What do you mean by this last choice?
>
> > If any options u thing please let me know.
> >
> > Should the module be multi threaded?
>
> Why would it be?
>
> > As I can't compromise with performance.
> >
> > Can I bind kernel threads to specific core?
>
> Yes, but are you sure you really want to do this in the kernel?  Can't
> you do this today already from userspace?
>
> thanks,
>
> greg k-h
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20160129/328b6eae/attachment.html 

Capture packets at 10g interface

[Greg KH]

On Fri, Jan 29, 2016 at 12:14:20AM +0530, Tarun Batra wrote:
> I want to do that because I have to write a packet inspection module sort of
> idps solution.

What is forcing you to do such a thing?  Is this for a homework
assignment, or are you trying to create a product?

> We are targeting kernel space because of performance.

How do you know that putting this in the kernel will be faster?  Do you
have measurements that show this?  Is doing this today somehow too slow
using the existing interfaces that allow you to do this?

thanks,

greg k-h

Capture packets at 10g interface

[Tarun Batra]

We are trying to build product and as per decisions of senior we need to
capture packets in kernel
On Jan 29, 2016 1:01 AM, "Greg KH" <greg@kroah.com> wrote:

> On Fri, Jan 29, 2016 at 12:14:20AM +0530, Tarun Batra wrote:
> > I want to do that because I have to write a packet inspection module
> sort of
> > idps solution.
>
> What is forcing you to do such a thing?  Is this for a homework
> assignment, or are you trying to create a product?
>
> > We are targeting kernel space because of performance.
>
> How do you know that putting this in the kernel will be faster?  Do you
> have measurements that show this?  Is doing this today somehow too slow
> using the existing interfaces that allow you to do this?
>
> thanks,
>
> greg k-h
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20160129/086736a2/attachment.html 

Capture packets at 10g interface

[Corey Sheldon]

@OP, Seems a bit  overkill but  due to a similar project please keep me
updated please



Corey W Sheldon
ph: +1 (310).909.7672
Freelance IT Consultant, Multi-Discipline Tutor
csheldon at ameridea.net                         corey84 at fedoraproject.org
              linuxmodder at keybase.io


Ameridea LLC, Founder, CTO                 Fedora Ambassador, North America
                 Server Team Intern, City-Gate
https://github.com/ameridea                   https://getfedora.org
                                https://city-gate.org

Find me elsewhere:
https://gist.github.com/linux-modder/ac5dc6fa211315c633c9

PGP: 0xCe2ad4c03a9eff1c FP= ba7e aeba 7c64 1eca f4b9  70a8 ce2a d4c0 3a9e
ff1c
PGP: 0x76ef54b9aed032e2 FP= 984e 1693 de66 2109 596c 0930 76ef 54b9 aed0
32e2

Tox: corey84 at toxme.io |
9357bc6a5944a08afc7d1effd61f6a73b9eabf8b2fb84acf1dac9a1a4d0a4705ffccd0e5499b
Linphone: sip:linuxmodder
BitAddress:15cn1BvAFEREHk8UekJ6i9Dxi9Wbw6vzDD

    "Have no way as way, no limitation as limitation. One must never
underestimate the power of boredom...from which creativity and laziness are
borne, which can spark great works of chaos and genius."


This document, including attachments, is intended for the person or company
named and contains confidential and/or legally privileged information.
Unauthorized disclosure, copying or use of this information may be unlawful
and is prohibited. If you are not the intended recipient, please destroy
this message and notify the sender.


On Fri, Jan 29, 2016 at 9:07 AM, Tarun Batra <tbatra18@gmail.com> wrote:

> We are trying to build product and as per decisions of senior we need to
> capture packets in kernel
> On Jan 29, 2016 1:01 AM, "Greg KH" <greg@kroah.com> wrote:
>
>> On Fri, Jan 29, 2016 at 12:14:20AM +0530, Tarun Batra wrote:
>> > I want to do that because I have to write a packet inspection module
>> sort of
>> > idps solution.
>>
>> What is forcing you to do such a thing?  Is this for a homework
>> assignment, or are you trying to create a product?
>>
>> > We are targeting kernel space because of performance.
>>
>> How do you know that putting this in the kernel will be faster?  Do you
>> have measurements that show this?  Is doing this today somehow too slow
>> using the existing interfaces that allow you to do this?
>>
>> thanks,
>>
>> greg k-h
>>
>
> _______________________________________________
> Kernelnewbies mailing list
> Kernelnewbies at kernelnewbies.org
> http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20160129/c96897f6/attachment-0001.html 

Capture packets at 10g interface

[Greg KH]

On Fri, Jan 29, 2016 at 07:37:57PM +0530, Tarun Batra wrote:
> We are trying to build product and as per decisions of senior we need to
> capture packets in kernel

Then I suggest you ask senior how to do this :)

Best of luck,

greg k-h

Capture packets at 10g interface

[Daniel Ng]

>> On Fri, Jan 29, 2016 at 07:37:57PM +0530, Tarun Batra wrote:
>> We are trying to build product and as per decisions of senior we need to
>> capture packets in kernel
> 
My understanding is 10G interfaces push traffic directly into userspace- the kernel is not involved at all here.

Cheers,
Daniel



> Then I suggest you ask senior how to do this :)
> 
> Best of luck,
> 
> greg k-h
> 
> _______________________________________________
> Kernelnewbies mailing list
> Kernelnewbies at kernelnewbies.org
> http://lists.kernelnewbies.org/mailman/listinfo/kernelnewbies

Capture packets at 10g interface

[Greg KH]

On Sat, Jan 30, 2016 at 12:19:28PM +1100, Daniel Ng wrote:
> 
> >> On Fri, Jan 29, 2016 at 07:37:57PM +0530, Tarun Batra wrote:
> >> We are trying to build product and as per decisions of senior we need to
> >> capture packets in kernel
> > 
> My understanding is 10G interfaces push traffic directly into
> userspace- the kernel is not involved at all here.

Some implementations do, some do not, it depends on the hardware and the
setup the user has created for this.  But to expect people on
kernelnewbies to design a product implementation for someone is a bit of
a streach for this group :)

thanks,

greg k-h

Capture packets at 10g interface

[Anupam Kapoor]

On Saturday 30 January 2016, Daniel Ng <daniel.ng1234@gmail.com> wrote:

>
> >> On Fri, Jan 29, 2016 at 07:37:57PM +0530, Tarun Batra wrote:
> >> We are trying to build product and as per decisions of senior we need to
> >> capture packets in kernel
> >
> My understanding is 10G interfaces push traffic directly into userspace-
> the kernel is not involved at all here.

depends, if you are doing kernel bypass then yes e.g dpdk and friends,
otherwise probably not.

---
thanks
anupam


-- 
In the beginning was the lambda, and the lambda was with Emacs, and Emacs
was the lambda.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.kernelnewbies.org/pipermail/kernelnewbies/attachments/20160130/9a05d77a/attachment.html