Re: [PATCH v4 0/4] add rpcap remote capture daemon

[Stephen Hemminger <stephen@networkplumber.org>]

On Thu, 1 Oct 2026 19:50:34 +0100
Marat Khalili <qm2k21@gmail.com> wrote:

> >    pcapng: add API to read back capture mbuf header  
> Analysis with AI tells that there are some opportunities to make the 
> fast path of lib/pcapng both lighter and less .pcapng-centric to make 
> life of consumers that prefer other formats easier. It does not have to 
> (probably even shouldn't) be a part of the current patchset though.

Thought about that, and also looked at making rpcap another library
but it ends up with DPDK reimplementing libpcap...

The other option would be using dynamic fields. There already is timestamp,
but there is none for "original packet length". 

Third option is not using pdump callbacks at all and just having rpcap
specific callbacks. That is what the Wireshark extcap does. That is where
I think this will end up. Would like to not use pdump since it has
so many design problems baked in.


> >    app/rpcapd: remote pcap daemon  
> Ideally forwarding captured data could run in a separate thread with 
> minimum unnecessary syscalls, although it's hard to tell without 
> benchmarks how much current design is slowed down by them.

New version does use a data forwarding thread.
It has to write to a socket, which it does with sendmsg.
It could use liburing, to reduce syscalls further.

> >    app/rpcapd: add TLS support  
> This patch simultaneously adds authentication, but it's only required 
> for non-loopback users. This is a common security vulnerability, not all 
> loopback users can be trusted. So if we care about authentication at 
> all, it should probably also be required for localhost users, at least 
> by default.

Good point, but do not want to add DPDK specific user data base.
The problem is that TCP loopback has no way to identify who is on the
other end. Unix domain sockets do, but libpcap doesn't support that.

The real long term answer is having plugins in libpcap (Robin's proposal)
and make this one of the plugins. But that will take longer to reach
agreement on.