Re: [dpdk-dev] tcpdump support in DPDK 2.3

[Aaron Conole <aconole@redhat.com>]

Matthew Hall <mhall@mhcomputing.net> writes:
>> The pcap file format contains a header in front of each packet, which is 
>> extremely simple. But it has a timestamp (which uses 32 bit for tv_sec and 
>> tv_usec in files), so it needs to be considered how to handle this 
>> efficiently.
>
> I already wrote some C code for generating the original pcap format files a 
> while ago which I think could be donated. For the timestamps to work at 
> highest efficiency we'd need to run an rte_timer every X microseconds that 
> updates a global volatile copy of tv_sec and tv_usec.
>
> Or make some code that calculates the offset of rte_rdtsc from 01 January 1970 
> 00:00:00 UTC and uses TSC value to generate the right tv_sec and tv_usec would 
> also work fine.

Why not just use libpcap to write out pcap files? I bet it does a better
job that any of us will ;) It's BSD licensed, so there should be no
issues with linking against it (DPDK currently does for the pcap PMD), and
it supports both pcap and pcap-ng (although -ng support may not be 100%,
I expect it will get better).

No need to donate to the cause on this one, I think :) The issues
surrounding tcpdump are, imo, ones of library/application workflow. HOW
does the user enable tcpdump-like support? The current option is to
start up with a pcap PMD configured, capture to a file for a bit, then
stop. I think the issues being discussed are what other options to give
the user. Then again, I may have my signals crossed somewhere.

-Aaron

> Matthew.