[RFC] pcapng: record received RSS hash in pcap file

[RFC] pcapng: record received RSS hash in pcap file

[Stephen Hemminger]

There is an option for recording RSS hash with packets in the
pcapng standard. This implements this for all received packets.

There is a corner case that can not be addressed with current
DPDK API's. If using rte_flow() and some hardware it is possible
to write a flow rule that uses another hash function like XOR.
But there is no API that records this, or provides the algorithm
info on a per-packet basis.

The current version of wireshark does not display the recorded
hash option. But if we build it they will come.

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
 lib/pcapng/rte_pcapng.c | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/lib/pcapng/rte_pcapng.c b/lib/pcapng/rte_pcapng.c
index 06ad712bd1eb..f7df3ddd64e8 100644
--- a/lib/pcapng/rte_pcapng.c
+++ b/lib/pcapng/rte_pcapng.c
@@ -4,6 +4,7 @@
 
 #include <errno.h>
 #include <net/if.h>
+#include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -453,9 +454,10 @@ rte_pcapng_copy(uint16_t port_id, uint32_t queue,
 	struct pcapng_enhance_packet_block *epb;
 	uint32_t orig_len, data_len, padding, flags;
 	struct pcapng_option *opt;
-	const uint16_t optlen = pcapng_optlen(sizeof(flags)) + pcapng_optlen(sizeof(queue));
+	uint16_t optlen;
 	struct rte_mbuf *mc;
 	uint64_t ns;
+	bool rss_hash;
 
 #ifdef RTE_LIBRTE_ETHDEV_DEBUG
 	RTE_ETH_VALID_PORTID_OR_ERR_RET(port_id, NULL);
@@ -488,6 +490,10 @@ rte_pcapng_copy(uint16_t port_id, uint32_t queue,
 			goto fail;
 	}
 
+	/* record HASH on incoming packets */
+	rss_hash = (direction == RTE_PCAPNG_DIRECTION_IN &&
+		    (md->ol_flags & RTE_MBUF_F_RX_RSS_HASH));
+
 	/* pad the packet to 32 bit boundary */
 	data_len = rte_pktmbuf_data_len(mc);
 	padding = RTE_ALIGN(data_len, sizeof(uint32_t)) - data_len;
@@ -499,6 +505,11 @@ rte_pcapng_copy(uint16_t port_id, uint32_t queue,
 		memset(tail, 0, padding);
 	}
 
+	optlen = pcapng_optlen(sizeof(flags));
+	optlen += pcapng_optlen(sizeof(queue));
+	if (rss_hash)
+		optlen += pcapng_optlen(sizeof(uint8_t) + sizeof(uint32_t));
+
 	/* reserve trailing options and block length */
 	opt = (struct pcapng_option *)
 		rte_pktmbuf_append(mc, optlen + sizeof(uint32_t));
@@ -522,6 +533,20 @@ rte_pcapng_copy(uint16_t port_id, uint32_t queue,
 	opt = pcapng_add_option(opt, PCAPNG_EPB_QUEUE,
 				&queue, sizeof(queue));
 
+	if (rss_hash) {
+		uint8_t hash_opt[5];
+
+		/* The algorithm could be something else if
+		 * using rte_flow_action_rss; but the current API does not
+		 * have a way for ethdev to report  this on a per-packet basis.
+		 */
+		hash_opt[0] = PCAPNG_HASH_TOEPLITZ;
+
+		memcpy(&hash_opt[1], &md->hash.rss, sizeof(uint32_t));
+		opt = pcapng_add_option(opt, PCAPNG_EPB_HASH,
+					&hash_opt, sizeof(hash_opt));
+	}
+
 	/* Note: END_OPT necessary here. Wireshark doesn't do it. */
 
 	/* Add PCAPNG packet header */
-- 
2.35.1

Re: [RFC] pcapng: record received RSS hash in pcap file

[Stephen Hemminger]

On Tue, 26 Jul 2022 14:36:19 -0700
Stephen Hemminger <stephen@networkplumber.org> wrote:

> There is an option for recording RSS hash with packets in the
> pcapng standard. This implements this for all received packets.
> 
> There is a corner case that can not be addressed with current
> DPDK API's. If using rte_flow() and some hardware it is possible
> to write a flow rule that uses another hash function like XOR.
> But there is no API that records this, or provides the algorithm
> info on a per-packet basis.
> 
> The current version of wireshark does not display the recorded
> hash option. But if we build it they will come.
> 

Wireshark support for displaying RSS hash is now in a pull request.

Re: [RFC] pcapng: record received RSS hash in pcap file

[Stephen Hemminger]

On Tue, 26 Jul 2022 14:36:19 -0700
Stephen Hemminger <stephen@networkplumber.org> wrote:

> There is an option for recording RSS hash with packets in the
> pcapng standard. This implements this for all received packets.
> 
> There is a corner case that can not be addressed with current
> DPDK API's. If using rte_flow() and some hardware it is possible
> to write a flow rule that uses another hash function like XOR.
> But there is no API that records this, or provides the algorithm
> info on a per-packet basis.
> 
> The current version of wireshark does not display the recorded
> hash option. But if we build it they will come.

Support for displaying RSS hash in record has been merged into
Wireshark for 4.1 release.

Could this please be acked and merged.

Re: [RFC] pcapng: record received RSS hash in pcap file

[Ben Magistro]

[-- Attachment #1: Type: text/plain, Size: 1025 bytes --]

Tested with Wireshark 4.1.0rc0-599-g708da4852678 (and older version to
confirm no issues)

Tested-by: Ben Magistro <koncept1@gmail.com>

On Fri, Oct 21, 2022 at 4:05 PM Stephen Hemminger <
stephen@networkplumber.org> wrote:

> On Tue, 26 Jul 2022 14:36:19 -0700
> Stephen Hemminger <stephen@networkplumber.org> wrote:
>
> > There is an option for recording RSS hash with packets in the
> > pcapng standard. This implements this for all received packets.
> >
> > There is a corner case that can not be addressed with current
> > DPDK API's. If using rte_flow() and some hardware it is possible
> > to write a flow rule that uses another hash function like XOR.
> > But there is no API that records this, or provides the algorithm
> > info on a per-packet basis.
> >
> > The current version of wireshark does not display the recorded
> > hash option. But if we build it they will come.
>
> Support for displaying RSS hash in record has been merged into
> Wireshark for 4.1 release.
>
> Could this please be acked and merged.
>

[-- Attachment #2: Type: text/html, Size: 1564 bytes --]

Re: [RFC] pcapng: record received RSS hash in pcap file

[David Marchand]

On Tue, Jul 26, 2022 at 11:37 PM Stephen Hemminger
<stephen@networkplumber.org> wrote:
>
> There is an option for recording RSS hash with packets in the
> pcapng standard. This implements this for all received packets.
>
> There is a corner case that can not be addressed with current
> DPDK API's. If using rte_flow() and some hardware it is possible
> to write a flow rule that uses another hash function like XOR.
> But there is no API that records this, or provides the algorithm
> info on a per-packet basis.
>
> The current version of wireshark does not display the recorded
> hash option. But if we build it they will come.

I updated the commitlog adding some info about "yet to be released
4.1" wireshark.

>
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Tested-by: Ben Magistro <koncept1@gmail.com>

Applied, thanks.


-- 
David Marchand