flow rule to drop all the packets

flow rule to drop all the packets

[Filip Janiszewski]

Hi,

Is there a way to create a flow rule that drops all the eth packets?
I've attempted to setup a flow rule that match any ether type but it's
never validated, for example a rule like:

.
    rte_flow_item_eth eth_spec{};
    eth_spec.hdr.ether_type = RTE_BE16(0x8100);
    rte_flow_item_eth eth_mask{};
    eth_mask.hdr.ether_type = 0xFFFF;
.

Should match every packet with ether type 0x8100, so I would assume that
setting ether_type for the mask to 0x0000 would trigger the card to
match everything regardless of the spec value, but it doesn't run
("Invalid input set" is the complain).

Also with testpmd I'm failing to make it work and the documentation on
this entire rte flow is pretty poor..

So, how do I configure a rule that drops all*? My use case would be that
I need to filter a link that is getting a lot of stuff, I'll drop all
but just certain flows that are relevant to me (using an higher priority
rule)..

Perhaps there's a way to configure an ingress rule that automatically
drops everything which is not matching the rule?

As a side note, I can't just disable RSS, spit all to queue 0 like it
was a void bucket (dropping/releasing) and then setting up rules for the
packets I need so that they get enqueue to some other queue, because:

1) I'll waste a cpu just for dropping packets
2) I'll probably get my stat reports full of imiss/errors since the link
is 100G and that poor queue is going to be getting tons of packets

Thanks


* I found this command:

.
testpmd> set all queues drop 0 on
function not implemented
.

But, it doesn't work.

-- 
BR, Filip
+48 666 369 823

Re: flow rule to drop all the packets

[Filip Janiszewski]

This issue exists only for Intel E810 NICs, using the Mellanox cards
I've in the lab a rule like this:

.
flow create 0 ingress pattern eth type spec 0x0000 type mask 0x0000 /
end actions drop / end
.

Will happily work and drop every packet, then I can create a new rule
with higher priority to capture just the packets I'm interested.

So I guess if there's some Intel guy they can have a look on why nothing
like this is supported in the DPDK ICE driver (or perhaps the nic?)

Thanks

Il 11/30/21 4:24 PM, Filip Janiszewski ha scritto:
> Hi,
> 
> Is there a way to create a flow rule that drops all the eth packets?
> I've attempted to setup a flow rule that match any ether type but it's
> never validated, for example a rule like:
> 
> .
>     rte_flow_item_eth eth_spec{};
>     eth_spec.hdr.ether_type = RTE_BE16(0x8100);
>     rte_flow_item_eth eth_mask{};
>     eth_mask.hdr.ether_type = 0xFFFF;
> .
> 
> Should match every packet with ether type 0x8100, so I would assume that
> setting ether_type for the mask to 0x0000 would trigger the card to
> match everything regardless of the spec value, but it doesn't run
> ("Invalid input set" is the complain).
> 
> Also with testpmd I'm failing to make it work and the documentation on
> this entire rte flow is pretty poor..
> 
> So, how do I configure a rule that drops all*? My use case would be that
> I need to filter a link that is getting a lot of stuff, I'll drop all
> but just certain flows that are relevant to me (using an higher priority
> rule)..
> 
> Perhaps there's a way to configure an ingress rule that automatically
> drops everything which is not matching the rule?
> 
> As a side note, I can't just disable RSS, spit all to queue 0 like it
> was a void bucket (dropping/releasing) and then setting up rules for the
> packets I need so that they get enqueue to some other queue, because:
> 
> 1) I'll waste a cpu just for dropping packets
> 2) I'll probably get my stat reports full of imiss/errors since the link
> is 100G and that poor queue is going to be getting tons of packets
> 
> Thanks
> 
> 
> * I found this command:
> 
> .
> testpmd> set all queues drop 0 on
> function not implemented
> .
> 
> But, it doesn't work.
> 

-- 
BR, Filip
+48 666 369 823