From: Stephen Hemminger <stephen@networkplumber.org>
To: dev@dpdk.org
Cc: Stephen Hemminger <stephen@networkplumber.org>
Subject: [PATCH v4 0/3] wireshark capture implementation
Date: Mon, 12 Oct 2026 20:41:02 -0700 [thread overview]
Message-ID: <20261013034145.979361-1-stephen@networkplumber.org> (raw)
In-Reply-To: <20260727224417.1419663-1-stephen@networkplumber.org>
This series adds live packet capture from a running DPDK application over the
telemetry socket. A new capture library installs Rx/Tx callbacks on an ethdev
port and writes pcapng to a FIFO, with an optional libpcap filter and
per-queue selection. A helper program presents those ports to Wireshark as
capture interfaces.
Advantages of this:
- no secondary process needed to capture
- installation is just putting the helper in the Wireshark extcap directory
- the helper has no dependency on DPDK libraries; can be packaged with
Wireshark
- allows for live capture
- supports BPF (with JIT) for filtering
How it works:
- The capture library registers telemetry commands (/ethdev/capture/*)
- Callbacks are installed on the specified port/queues to copy packets
- Packets are formatted as pcapng and written to the specified output
- No packet data passes through the telemetry socket itself
Packets handled by a secondary process are captured too, using EAL IPC as
pdump does.
The helper is a C program so that it can be installed with privilege, which
is what lets Wireshark capture from a root application without itself running
as root. See doc/guides/tools/wireshark_extcap.rst.
Linux and FreeBSD only. Windows needs the transport first: telemetry has no
socket server there and uses SOCK_SEQPACKET, which Windows AF_UNIX lacks.
A stream socket would need the replies framed.
Testing:
- dpdk-wireshark-extcap --extcap-interfaces lists the ports. Reasons for an
empty list go to stderr, which the Wireshark GUI hides.
- Unit tests are in app/test/test_capture.c
- Tested on Linux capturing from a root application as a non-root user.
The unit test also passes on FreeBSD.
v4
- helper rewritten in C, and can be installed with privilege so Wireshark
need not run as the same user as the DPDK application
- capture packets handled by secondary processes
- split the library into several files by area
- dropped the pcapng change adding the filter-accepted count to the
interface statistics block. Still reported through telemetry.
v3 - fixed AI review feedback
Stephen Hemminger (3):
capture: infrastructure wireshark packet capture
test: add test for capture hooks
usertools: add script for wireshark capture
MAINTAINERS | 4 +
app/test/meson.build | 1 +
app/test/test_capture.c | 688 ++++++++++++++
doc/guides/prog_guide/capture_lib.rst | 167 ++++
doc/guides/prog_guide/index.rst | 1 +
doc/guides/rel_notes/release_26_11.rst | 5 +
doc/guides/tools/index.rst | 1 +
doc/guides/tools/wireshark_extcap.rst | 198 ++++
lib/capture/capture.c | 560 ++++++++++++
lib/capture/datapath.c | 420 +++++++++
lib/capture/filter.c | 180 ++++
lib/capture/meson.build | 24 +
lib/capture/multiproc.c | 246 +++++
lib/capture/output.c | 294 ++++++
lib/capture/private.h | 214 +++++
lib/meson.build | 1 +
usertools/dpdk-wireshark-extcap.c | 1145 ++++++++++++++++++++++++
usertools/meson.build | 23 +
18 files changed, 4172 insertions(+)
create mode 100644 app/test/test_capture.c
create mode 100644 doc/guides/prog_guide/capture_lib.rst
create mode 100644 doc/guides/tools/wireshark_extcap.rst
create mode 100644 lib/capture/capture.c
create mode 100644 lib/capture/datapath.c
create mode 100644 lib/capture/filter.c
create mode 100644 lib/capture/meson.build
create mode 100644 lib/capture/multiproc.c
create mode 100644 lib/capture/output.c
create mode 100644 lib/capture/private.h
create mode 100644 usertools/dpdk-wireshark-extcap.c
--
2.53.0
next prev parent reply other threads:[~2026-10-13 3:41 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-24 21:11 [PATCH v6 0/5] Wireshark external capture for DPDK Stephen Hemminger
2026-07-24 21:11 ` [PATCH 1/5] pcapng: extend interface statistics Stephen Hemminger
2026-07-24 21:11 ` [PATCH 2/5] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-07-24 21:11 ` [PATCH 3/5] test: add test for capture hooks Stephen Hemminger
2026-07-24 21:11 ` [PATCH 4/5] usertools/dpdk-wireshark-extcap.py: script for external capture Stephen Hemminger
2026-07-24 21:11 ` [PATCH 5/5] usertools/dpdk-dumpcap: add script for file capture Stephen Hemminger
2026-07-27 22:42 ` [PATCH v2 0/4] Wireshark external capture interface Stephen Hemminger
2026-07-27 22:42 ` [PATCH v2 1/4] pcapng: extend interface statistics Stephen Hemminger
2026-07-27 22:42 ` [PATCH v2 2/4] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-07-27 22:42 ` [PATCH v2 3/4] test: add test for capture hooks Stephen Hemminger
2026-07-27 22:42 ` [PATCH v2 4/4] usertools: add script for wireshark capture Stephen Hemminger
2026-07-29 23:28 ` Stephen Hemminger
2026-07-30 18:22 ` [PATCH v3 0/4] Wireshark external capture Stephen Hemminger
2026-07-30 18:22 ` [PATCH v3 1/4] pcapng: extend interface statistics Stephen Hemminger
2026-07-30 18:22 ` [PATCH v3 2/4] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-07-30 18:22 ` [PATCH v3 3/4] test: add test for capture hooks Stephen Hemminger
2026-07-30 18:22 ` [PATCH v3 4/4] usertools: add script for wireshark capture Stephen Hemminger
2026-10-13 3:41 ` Stephen Hemminger [this message]
2026-10-13 3:41 ` [PATCH v4 1/3] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-10-13 3:41 ` [PATCH v4 2/3] test: add test for capture hooks Stephen Hemminger
2026-10-13 3:41 ` [PATCH v4 3/3] usertools: add script for wireshark capture Stephen Hemminger
2026-10-13 8:28 ` [PATCH v4 0/3] wireshark capture implementation fengchengwen
2026-10-13 14:19 ` Stephen Hemminger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261013034145.979361-1-stephen@networkplumber.org \
--to=stephen@networkplumber.org \
--cc=dev@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.