From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mails.dpdk.org (mails.dpdk.org [217.70.189.124]) by inbox.dpdk.org (Postfix) with ESMTP id 662B1A04FD; Tue, 27 Dec 2022 17:43:16 +0100 (CET) Received: from mails.dpdk.org (localhost [127.0.0.1]) by mails.dpdk.org (Postfix) with ESMTP id DEAD340FDF; Tue, 27 Dec 2022 17:43:15 +0100 (CET) Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) by mails.dpdk.org (Postfix) with ESMTP id B624E40DDB for ; Tue, 27 Dec 2022 17:43:14 +0100 (CET) Received: by mail-pf1-f175.google.com with SMTP id a14so9189188pfa.1 for ; Tue, 27 Dec 2022 08:43:14 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=networkplumber-org.20210112.gappssmtp.com; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:from:to:cc:subject:date :message-id:reply-to; bh=yxF+CPE/qRgzR8BrFHsw0ZSe+3ef46MfgUbbNgwgjhg=; b=3TF6ZR+RWep3czlXpatEses3KDou4ZTQvY1hPuuAwNuHYtNsIFsx51kNyw8DFrx/FK FRV9pZrXBvNGzdpA7WC2GdbZbHndJd2ODsnokNE7tLCR+ZUR8bW9DX7GGc/1PwBBB6Cl SoKbaXkEeSrCXF7kMOYIa1ugIkTs/h2QnBxpPsuhCjv9VxuYIzAFUGdT6kUfodotdUNW uiH06ltE3m0Fv9M7CLUUnCnbJY0oQ/0X4R/A7dw5VMz3dLfpfnwfLGR2Hjit6+YP2gPB 2ePltV62mluUbxzj/E6SQCShZB/ftN5ZQorPelCI7UVXN84aZcxZll+QHFrtwp7pp6Pl fGiQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:subject:cc:to:from:date:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=yxF+CPE/qRgzR8BrFHsw0ZSe+3ef46MfgUbbNgwgjhg=; b=ZfB6NON1vIMlBxqc/rBL4t0yOhhytfRLstAHurY5HFjjCrfsIi1JqdOd6WU3wOz2l9 QrKMw/zjYEzYmRDRztki56Ai9aVlWgyYQW4iejC4jDwwcoUWzMhRXkdwKj4SvRDU+J+v DjVfULMBnrPJK2ACVvpeTvcov4ZwTa7AYcIRM8/YTx5d/irg8iBzo1Y0ICnPmoPtBzxk cZG00pCMyPE3gZWvpxVuLtYnieUeKIkNT5WUza24cgfjbkKba3dVXHcLcdnTneJKt1WZ ANnyqHpYVS75k9K5OK8hzm8FYNrgb00Psrni7/HYOQNtTbLA2+WCG5HC8KzIGrhMel5b dUcw== X-Gm-Message-State: AFqh2kqs3X6tHuw2kpwkM3DbHOxQJlxLUhShJ0xM8B+la9kMYp7gmsKG JF0L9Sq6sGivoCriSElf6U+mSg== X-Google-Smtp-Source: AMrXdXsnDeKA74ahuUU8w70cBXSCzG8V4cXnBJM/+Om8byTGfEfw+rXwAHLSY0hTO52RLMdzHb534w== X-Received: by 2002:a05:6a00:2143:b0:580:d91:5598 with SMTP id o3-20020a056a00214300b005800d915598mr29658122pfk.21.1672159393759; Tue, 27 Dec 2022 08:43:13 -0800 (PST) Received: from hermes.local (204-195-120-218.wavecable.com. [204.195.120.218]) by smtp.gmail.com with ESMTPSA id r29-20020aa79edd000000b005764a143be3sm8810474pfq.103.2022.12.27.08.43.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 27 Dec 2022 08:43:13 -0800 (PST) Date: Tue, 27 Dec 2022 08:43:11 -0800 From: Stephen Hemminger To: Ben Magistro Cc: dev@dpdk.org, "Kaur, Arshdeep" , ben.magistro@trinitycyber.com Subject: Re: dumpcap, interfaces, and promiscuous mode Message-ID: <20221227084311.54d1fe96@hermes.local> In-Reply-To: References: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-BeenThere: dev@dpdk.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: DPDK patches and discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: dev-bounces@dpdk.org On Tue, 27 Dec 2022 09:26:14 -0500 Ben Magistro wrote: > I'd like to start out by saying what I believed to be a simple change > (a8dde09 ("app/dumpcap: allow help/version without primary process")) seems > to have had more ripples than I anticipated. I'd like to just get a > conversation going here before developing/submitting a patch. I think this > will likely need to be at least two patches just to keep scope in check. > > With regard to interface selection, the most recent patch (7f3623a > ("app/dumpcap: fix select interface")) breaks capturing on > multiple interfaces. You can still specify the `-i` option as many times > as you would like but only the last entry is used in the capture selection > as each entry just overwrites the previous entry. I believe this needs to > be flipped to an array or similar structure that can have entries > appended to it as the arguments are processed. Selecting all interfaces > with the asterisk seems to be unaffected but could also result in capturing > traffic on unnecessary interfaces. > > With regard to promiscuous mode, there are two areas of concern here. The > first is this flag is global and not per interface. I can envision a > scenario where you might want to capture on one interface in promiscuous > mode and on a second not in promiscuous mode. My first thought is to make > this option follow the interface parameter then when parsing arguments so > that it can be associated with a specific interface. The second is that if > I run a capture in promiscuous mode and then stop the capture, it will also > disable promiscuous mode. Generally I think I would agree with this > behavior as it follows how a typical call to tcpdump should behave. The > concern here though is that that the main process may have been > started/running with promiscuous mode and stopping a capture would change > that mode for the main process. My first thought here is to query the > initial state and check that when quitting to know if it should disable > promiscuous mode or not. This brings me to another aspect here and I don't > think changing the behaviour of the `-p` flag is appropriate, but can see > maybe adding an option to inherit the main process's promiscuous state(s) > when starting. > > Happy to try and work on some of these changes but want to talk through the > issues first so we can try to address all of them. > > Cheers, > > Ben Magistro I believe all this got fixed by the 22.11 version. Since dumpcap has interface parameter, it should only enable the ones it is using. The user interface for the DPDK version of dumpcap is modeled after the wireshark version. In general would not like to invent lots of new DPDK specific options here.