Buffering and libnetfilter

Buffering and libnetfilter

[Kristian Evensen]

Hello,

I am currently working a small user space program that queues packets
sent from kernel space and after a while passes them "back" to the
kernel. However, when the bandwidth is high, there seems to be some
buffer-problems. Suddenly my application stops receiving packets from
netlink and no packets get through.

First I thought it might be that I have exceeded the allowed queue
length, but that is not the case. The id of the last received packet
is well below 1024. Does anyone know what might be wrong or have any
tips? Also, is it possible to adjust netfilter's buffersize?

-Kristian

Re: Buffering and libnetfilter

[Kristian Evensen]

I forgot to add a couple of things. I have tried adjusting the
receiver buffer size with nfnl_rcvbufsiz and also adjusted the rmem
and wmem-proc variables.

I currently just use the test application that comes with the code,
but I never forward the packets (the callback-function just returns
1). Of course the final application want to do this, but my goal is to
find out about the buffersize, how many packets I can keep on the
NFQUEUE and how to make sure I later stay within the limits. When
testing I use iperf and what happens is that the test application
suddenly stops printing out messages (after queuing 37 packets).

Thanks,
Kristian

Re: Buffering and libnetfilter

[Kristian Evensen]

Hello again,

After doing some more debugging, I have come a bit closer to answering 
my question. However, there is one thing still puzzling me.

I wrote a small application that uses select to multiplex between stdin 
and the kernelsocket. When a netfilter-packet arrives, the packet_id is 
registered in a list and the callback function returns 1. The user can 
input the id of the packet he or she wants to have sent, and I use 
nfq_set_verdict to allow the packet to continue its journey through the 
kernel.

When using this application, the same as with the test application 
occurs. If I don't allow any packets to continue through the kernel, 
netfilter_queue stops delivering new packets to the application after a 
little while (recv/select just blocks). However, when I input a corret 
id and allow the kernel to continue sending a packet, netfilter 
deliveres a new packet immideatly (where packet_id == 
prev_highest_packet_id + 1). So, my question now is, why do 
netfilter_queue stop delivering new packets in the first place? I have 
tried both tweaking the queue lenght (using nfnl_recv_bufsiz) and 
setting it to extremely high values, and played around with the 
proc-variables that control network memory consumption.

Thanks in advance for any help,
Kristian