tcpdump mailing list archives

Re: best strategy for receiving millions-packets-per-second


From: "Montorsi, Francesco via tcpdump-workers" <tcpdump-workers () lists tcpdump org>
Date: Mon, 4 May 2020 08:59:11 -0400 (EDT)

--- Begin Message --- From: "Montorsi, Francesco" <fmontorsi () empirix com>
Date: Mon, 4 May 2020 13:00:45 +0000

Hi Ray,

On 04/05/2020 11:08, Montorsi, Francesco wrote:
a) what's the best way to load-balance received packets across a pool of threads / CPU cores: libpcap API is 
single-thread right?

Assuming Linux (since you mentioned DPDK) 
yes, right  - I forgot to mention that.

you can get per-packet
load-balancing by forgetting libpcap and going straight for `AF_PACKET`
and then use the ioctl `PACKET_FANOUT_CPU` to keep packets on whichever
CPU core handles that RX queue.

Thanks for pointing this out, that was my same suspect.


You need sufficient entropy on the incoming packets IP and port fields
for the RSS algortihm to ensure effective per-queue balancing on the
traffic.
See slide 11 onwards from my presentation here:
<https://indico.dns-oarc.net/event/31/contributions/691/attachments/656/1078/Local_Root.pdf>

Thanks I had a look.
My problem is that very often my application will receive packets encapsulated through GRE/ERSPAN or GTPU tunnelling 
protocols
so that the outer IP addresses that Linux will use for hashing and dispatching across queues risk to be always the same.
That would mean close-to-zero entropy and all packets dispatched to the same CPU core.
I guess I would use PACKET_FANOUT_LB to distribute traffic on a set of intermediate CPUs that would compute the hash 
using the 
tunnelled IP addresses instead of the "outer" ones and then redistribute packets over the actual worker threads...

Do you know if there is any plan to get AF_PACKET support in libpcap anytime soon?

Thanks,
Francesco

--- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers

Current thread: