From: Stephen Hemminger <stephen@networkplumber.org>
To: dev@dpdk.org
Cc: Stephen Hemminger <stephen@networkplumber.org>
Subject: [PATCH v5 0/4] wireshark extcap support
Date: Fri, 16 Oct 2026 15:30:30 -0700 [thread overview]
Message-ID: <20261016223201.608942-1-stephen@networkplumber.org> (raw)
In-Reply-To: <20260727224417.1419663-1-stephen@networkplumber.org>
This series adds live packet capture from a running DPDK application
over the telemetry socket which is usable as a source of Wireshark
external capture (https://www.wireshark.org/docs/man-pages/extcap.html)
Capture is avaliable by default but can be disabled on the command
line with --no-capture. It works on Linux and FreeBSD.
How it works:
- The capture library registers telemetry commands (/ethdev/capture/*)
- Callbacks are installed on the specified port/queues to copy packets
- Packets are formatted as pcapng and written to the specified output
- No packet data passes through the telemetry socket itself
Advantages of this:
- no secondary process needed to capture
- installation is just putting the helper in the extcap directory
- the helper has no dependency on DPDK libraries,
so it can be packaged with Wireshark
- allows for live capture
- supports BPF (with JIT) for filtering
Implementation Details:
- uses it is own version of userspace RCU to allow for callback
to not need read-modify-write operations. Existing DPDK QSBR
is ununsuitable because it requires the application to report quiescent
states, and the point here is that the application stays unchanged.
This RCU implementation could be integrated later into existing library.
- helper is a C program so that it can be installed with privilege.
That is what lets Wireshark capture from a root application
without itself running as root.
See doc/guides/tools/wireshark_extcap.rst.
- Windows support is not possible with current design because
telemetry is not available on DPDK for Windows.
Testing:
- dpdk-wireshark-extcap --extcap-interfaces lists the ports.
Reasons for an empty list go to stderr, which the GUI hides.
- Unit tests are in app/test/test_capture.c
- Tested on Linux capturing from a root application as a non-root
user. The unit test also passes on FreeBSD.
v5
- fix build errors on FreeBSD
- split into smaller files
- callbacks use a local userspace RCU instead of a use count,
so the datapath has no atomic read-modify-write
- added the --no-capture EAL option
- renamed the internal filter API, it was using an rte_ prefix
for something private to the library
Stephen Hemminger (4):
capture: infrastructure wireshark packet capture
eal: add --no-capture option
test: add test for capture hooks
usertools: add script for wireshark capture
MAINTAINERS | 5 +
app/test/meson.build | 1 +
app/test/test_capture.c | 688 ++++++++++
doc/guides/linux_gsg/eal_args.include.rst | 4 +
doc/guides/prog_guide/capture_lib.rst | 196 +++
.../prog_guide/img/capture_overview.svg | 49 +
doc/guides/prog_guide/index.rst | 1 +
doc/guides/rel_notes/release_26_11.rst | 5 +
doc/guides/tools/index.rst | 1 +
doc/guides/tools/wireshark_extcap.rst | 203 +++
lib/capture/capture.c | 661 ++++++++++
lib/capture/datapath.c | 414 ++++++
lib/capture/filter.c | 179 +++
lib/capture/meson.build | 42 +
lib/capture/multiproc.c | 250 ++++
lib/capture/output.c | 311 +++++
lib/capture/private.h | 233 ++++
lib/capture/rcu.c | 258 ++++
lib/capture/rcu.h | 112 ++
lib/eal/common/eal_common_config.c | 7 +
lib/eal/common/eal_common_options.c | 3 +
lib/eal/common/eal_internal_cfg.h | 1 +
lib/eal/common/eal_option_list.h | 1 +
lib/eal/include/rte_eal.h | 9 +
lib/meson.build | 1 +
usertools/dpdk-wireshark-extcap.c | 1131 +++++++++++++++++
usertools/meson.build | 23 +
27 files changed, 4789 insertions(+)
create mode 100644 app/test/test_capture.c
create mode 100644 doc/guides/prog_guide/capture_lib.rst
create mode 100644 doc/guides/prog_guide/img/capture_overview.svg
create mode 100644 doc/guides/tools/wireshark_extcap.rst
create mode 100644 lib/capture/capture.c
create mode 100644 lib/capture/datapath.c
create mode 100644 lib/capture/filter.c
create mode 100644 lib/capture/meson.build
create mode 100644 lib/capture/multiproc.c
create mode 100644 lib/capture/output.c
create mode 100644 lib/capture/private.h
create mode 100644 lib/capture/rcu.c
create mode 100644 lib/capture/rcu.h
create mode 100644 usertools/dpdk-wireshark-extcap.c
--
2.53.0
next prev parent reply other threads:[~2026-10-16 22:32 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-24 21:11 [PATCH v6 0/5] Wireshark external capture for DPDK Stephen Hemminger
2026-07-24 21:11 ` [PATCH 1/5] pcapng: extend interface statistics Stephen Hemminger
2026-07-24 21:11 ` [PATCH 2/5] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-07-24 21:11 ` [PATCH 3/5] test: add test for capture hooks Stephen Hemminger
2026-07-24 21:11 ` [PATCH 4/5] usertools/dpdk-wireshark-extcap.py: script for external capture Stephen Hemminger
2026-07-24 21:11 ` [PATCH 5/5] usertools/dpdk-dumpcap: add script for file capture Stephen Hemminger
2026-07-27 22:42 ` [PATCH v2 0/4] Wireshark external capture interface Stephen Hemminger
2026-07-27 22:42 ` [PATCH v2 1/4] pcapng: extend interface statistics Stephen Hemminger
2026-07-27 22:42 ` [PATCH v2 2/4] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-07-27 22:42 ` [PATCH v2 3/4] test: add test for capture hooks Stephen Hemminger
2026-07-27 22:42 ` [PATCH v2 4/4] usertools: add script for wireshark capture Stephen Hemminger
2026-07-29 23:28 ` Stephen Hemminger
2026-07-30 18:22 ` [PATCH v3 0/4] Wireshark external capture Stephen Hemminger
2026-07-30 18:22 ` [PATCH v3 1/4] pcapng: extend interface statistics Stephen Hemminger
2026-07-30 18:22 ` [PATCH v3 2/4] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-07-30 18:22 ` [PATCH v3 3/4] test: add test for capture hooks Stephen Hemminger
2026-07-30 18:22 ` [PATCH v3 4/4] usertools: add script for wireshark capture Stephen Hemminger
2026-10-13 3:41 ` [PATCH v4 0/3] wireshark capture implementation Stephen Hemminger
2026-10-13 3:41 ` [PATCH v4 1/3] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-10-13 3:41 ` [PATCH v4 2/3] test: add test for capture hooks Stephen Hemminger
2026-10-13 3:41 ` [PATCH v4 3/3] usertools: add script for wireshark capture Stephen Hemminger
2026-10-13 8:28 ` [PATCH v4 0/3] wireshark capture implementation fengchengwen
2026-10-13 14:19 ` Stephen Hemminger
2026-10-16 22:30 ` Stephen Hemminger [this message]
2026-10-16 22:30 ` [PATCH v5 1/4] capture: infrastructure wireshark packet capture Stephen Hemminger
2026-10-16 22:30 ` [PATCH v5 2/4] eal: add --no-capture option Stephen Hemminger
2026-10-16 22:30 ` [PATCH v5 3/4] test: add test for capture hooks Stephen Hemminger
2026-10-16 22:30 ` [PATCH v5 4/4] usertools: add script for wireshark capture Stephen Hemminger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261016223201.608942-1-stephen@networkplumber.org \
--to=stephen@networkplumber.org \
--cc=dev@dpdk.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox