Re: [dpdk-dev] [PATCH v3 0/5] add dpdk packet capture support for tcpdump

["Pattan, Reshma" <reshma.pattan@intel.com>]

Hi Thomas,

> -----Original Message-----
> From: Thomas Monjalon [mailto:thomas.monjalon@6wind.com]
> Sent: Wednesday, March 9, 2016 12:34 AM
> To: Pattan, Reshma <reshma.pattan@intel.com>
> Cc: dev@dpdk.org
> Subject: Re: [dpdk-dev] [PATCH v3 0/5] add dpdk packet capture support for
> tcpdump
> 
> Hi,
> 
> This series has not been reviewed enough to be ready for 16.04.
> So it would be good to restart the discussion about the tcpdump requirements.

Yes, will plan for next steps.

> 
> > packet capture flow for tcpdump:
> > ================================
> > Part of the design is implemented in secondary process (proc_info.c)
> > and other part in primary process (eal_interrupt.c).
> 
> Why proc_info is used? Why not a dedicated tool?


proc_info or any other new tool,  it must be secondary process. 
proc_info is already simple secondary process and does take care  of printing dpdk port's packet statistics upon users request,
hence same application was enhanced for dpdk packet capturing support.

> 
> > *User should request packet capture via proc_info application command
> > line by passing newly added tcpdump command line options i.e.
> > [--tcpdump (port,queue)] [ --src-ip-filter \"A.B.C.D\"] [--single-tcpdump-file].
> >
> > Note: As basic support, a src ip filter option is provided for filtering the
> packets.
> > This is optional. If user dont provide any src ip filter option all
> > packets will be captured for tcpdump.
> 
> Why filtering? Why only on IP address? Why not BPF?
> 

Here, simple src-ip-filtering was demonstrated to give an idea on where filtering logic can fit in this design.
The filtering logic can be enhanced with BPF or by other filtering methods. This also improves performance.


> > 2: Because of the underlying pcap writing overhead packets can only be
> captured at slow rates.
> 
> What is the benefit of slow rate capture in DPDK?
> Shouldn't we target a high rate mechanism?

I believe there will be performance improvements if we also use TUN/TAP PMD, but this is not up streamed  in to DPDK.

Thanks,
Reshma