dev.dpdk.org archive mirror
 help / color / mirror / Atom feed
From: Stephen Hemminger <stephen@networkplumber.org>
To: dev@dpdk.org
Cc: Stephen Hemminger <stephen@networkplumber.org>
Subject: [PATCH v4 0/3] wireshark capture implementation
Date: Mon, 12 Oct 2026 20:41:02 -0700	[thread overview]
Message-ID: <20261013034145.979361-1-stephen@networkplumber.org> (raw)
In-Reply-To: <20260727224417.1419663-1-stephen@networkplumber.org>

This series adds live packet capture from a running DPDK application over the
telemetry socket. A new capture library installs Rx/Tx callbacks on an ethdev
port and writes pcapng to a FIFO, with an optional libpcap filter and
per-queue selection. A helper program presents those ports to Wireshark as
capture interfaces.

Advantages of this:
 - no secondary process needed to capture
 - installation is just putting the helper in the Wireshark extcap directory
 - the helper has no dependency on DPDK libraries; can be packaged with
   Wireshark
 - allows for live capture
 - supports BPF (with JIT) for filtering

How it works:
 - The capture library registers telemetry commands (/ethdev/capture/*)
 - Callbacks are installed on the specified port/queues to copy packets
 - Packets are formatted as pcapng and written to the specified output
 - No packet data passes through the telemetry socket itself

Packets handled by a secondary process are captured too, using EAL IPC as
pdump does.

The helper is a C program so that it can be installed with privilege, which
is what lets Wireshark capture from a root application without itself running
as root. See doc/guides/tools/wireshark_extcap.rst.

Linux and FreeBSD only. Windows needs the transport first: telemetry has no
socket server there and uses SOCK_SEQPACKET, which Windows AF_UNIX lacks.
A stream socket would need the replies framed.

Testing:
  - dpdk-wireshark-extcap --extcap-interfaces lists the ports. Reasons for an
    empty list go to stderr, which the Wireshark GUI hides.
  - Unit tests are in app/test/test_capture.c
  - Tested on Linux capturing from a root application as a non-root user.
    The unit test also passes on FreeBSD.

v4
 - helper rewritten in C, and can be installed with privilege so Wireshark
   need not run as the same user as the DPDK application
 - capture packets handled by secondary processes
 - split the library into several files by area
 - dropped the pcapng change adding the filter-accepted count to the
   interface statistics block. Still reported through telemetry.

v3 - fixed AI review feedback

Stephen Hemminger (3):
  capture: infrastructure wireshark packet capture
  test: add test for capture hooks
  usertools: add script for wireshark capture

 MAINTAINERS                            |    4 +
 app/test/meson.build                   |    1 +
 app/test/test_capture.c                |  688 ++++++++++++++
 doc/guides/prog_guide/capture_lib.rst  |  167 ++++
 doc/guides/prog_guide/index.rst        |    1 +
 doc/guides/rel_notes/release_26_11.rst |    5 +
 doc/guides/tools/index.rst             |    1 +
 doc/guides/tools/wireshark_extcap.rst  |  198 ++++
 lib/capture/capture.c                  |  560 ++++++++++++
 lib/capture/datapath.c                 |  420 +++++++++
 lib/capture/filter.c                   |  180 ++++
 lib/capture/meson.build                |   24 +
 lib/capture/multiproc.c                |  246 +++++
 lib/capture/output.c                   |  294 ++++++
 lib/capture/private.h                  |  214 +++++
 lib/meson.build                        |    1 +
 usertools/dpdk-wireshark-extcap.c      | 1145 ++++++++++++++++++++++++
 usertools/meson.build                  |   23 +
 18 files changed, 4172 insertions(+)
 create mode 100644 app/test/test_capture.c
 create mode 100644 doc/guides/prog_guide/capture_lib.rst
 create mode 100644 doc/guides/tools/wireshark_extcap.rst
 create mode 100644 lib/capture/capture.c
 create mode 100644 lib/capture/datapath.c
 create mode 100644 lib/capture/filter.c
 create mode 100644 lib/capture/meson.build
 create mode 100644 lib/capture/multiproc.c
 create mode 100644 lib/capture/output.c
 create mode 100644 lib/capture/private.h
 create mode 100644 usertools/dpdk-wireshark-extcap.c

-- 
2.53.0


  parent reply	other threads:[~2026-10-13  3:41 UTC|newest]

Thread overview: 23+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-24 21:11 [PATCH v6 0/5] Wireshark external capture for DPDK Stephen Hemminger
2026-07-24 21:11 ` [PATCH 1/5] pcapng: extend interface statistics Stephen Hemminger
2026-07-24 21:11 ` [PATCH 2/5] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-07-24 21:11 ` [PATCH 3/5] test: add test for capture hooks Stephen Hemminger
2026-07-24 21:11 ` [PATCH 4/5] usertools/dpdk-wireshark-extcap.py: script for external capture Stephen Hemminger
2026-07-24 21:11 ` [PATCH 5/5] usertools/dpdk-dumpcap: add script for file capture Stephen Hemminger
2026-07-27 22:42 ` [PATCH v2 0/4] Wireshark external capture interface Stephen Hemminger
2026-07-27 22:42   ` [PATCH v2 1/4] pcapng: extend interface statistics Stephen Hemminger
2026-07-27 22:42   ` [PATCH v2 2/4] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-07-27 22:42   ` [PATCH v2 3/4] test: add test for capture hooks Stephen Hemminger
2026-07-27 22:42   ` [PATCH v2 4/4] usertools: add script for wireshark capture Stephen Hemminger
2026-07-29 23:28     ` Stephen Hemminger
2026-07-30 18:22   ` [PATCH v3 0/4] Wireshark external capture Stephen Hemminger
2026-07-30 18:22     ` [PATCH v3 1/4] pcapng: extend interface statistics Stephen Hemminger
2026-07-30 18:22     ` [PATCH v3 2/4] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-07-30 18:22     ` [PATCH v3 3/4] test: add test for capture hooks Stephen Hemminger
2026-07-30 18:22     ` [PATCH v3 4/4] usertools: add script for wireshark capture Stephen Hemminger
2026-10-13  3:41   ` Stephen Hemminger [this message]
2026-10-13  3:41     ` [PATCH v4 1/3] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-10-13  3:41     ` [PATCH v4 2/3] test: add test for capture hooks Stephen Hemminger
2026-10-13  3:41     ` [PATCH v4 3/3] usertools: add script for wireshark capture Stephen Hemminger
2026-10-13  8:28     ` [PATCH v4 0/3] wireshark capture implementation fengchengwen
2026-10-13 14:19       ` Stephen Hemminger

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261013034145.979361-1-stephen@networkplumber.org \
    --to=stephen@networkplumber.org \
    --cc=dev@dpdk.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).