|
 |
0a13d0 |
From 39dc303ae890f22f7c603d4de3f46e0b934f8674 Mon Sep 17 00:00:00 2001
|
|
|
0a13d0 |
From: Daniel Borkmann <daniel@iogearbox.net>
|
|
|
0a13d0 |
Date: Wed, 22 Apr 2015 22:11:50 +0200
|
|
|
0a13d0 |
Subject: [PATCH 3/4] man: netsniff-ng: document fanout options
|
|
|
0a13d0 |
|
|
|
0a13d0 |
Upstream commit: a6d81446c350218e36e53716ff277886069794b9
|
|
|
0a13d0 |
|
|
|
0a13d0 |
--
|
|
|
0a13d0 |
|
|
|
0a13d0 |
man: netsniff-ng: document fanout options
|
|
|
0a13d0 |
|
|
|
0a13d0 |
Properly document the new knobs for doing packet socket's fanout, i.e.
|
|
|
0a13d0 |
that is, --fanout-group/--fanout-type/--fanout-opts.
|
|
|
0a13d0 |
|
|
|
0a13d0 |
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
|
0a13d0 |
---
|
|
|
0a13d0 |
netsniff-ng.8 | 25 +++++++++++++++++++++++++
|
|
|
0a13d0 |
1 file changed, 25 insertions(+)
|
|
|
0a13d0 |
|
|
|
0a13d0 |
diff --git a/netsniff-ng.8 b/netsniff-ng.8
|
|
|
0a13d0 |
index 5915595..3d97f0d 100644
|
|
|
0a13d0 |
--- a/netsniff-ng.8
|
|
|
0a13d0 |
+++ b/netsniff-ng.8
|
|
|
0a13d0 |
@@ -84,6 +84,31 @@ stdout is given as a device, then a trafgen configuration will be written to
|
|
|
0a13d0 |
stdout if the input device is a pcap file, or a pcap file if the input device
|
|
|
0a13d0 |
is a networking device.
|
|
|
0a13d0 |
.PP
|
|
|
0a13d0 |
+.SS -C <id>, --fanout-group <id>
|
|
|
0a13d0 |
+If multiple netsniff-ng instances are being started that all have the same packet
|
|
|
0a13d0 |
+fanout group id, then the ingress network traffic being captured is being
|
|
|
0a13d0 |
+distributed/load-balanced among these group participants. This gives a much better
|
|
|
0a13d0 |
+scaling than running multiple netsniff-ng processes without a fanout group parameter
|
|
|
0a13d0 |
+in parallel, but only with a BPF filter attached as a packet would otherwise need
|
|
|
0a13d0 |
+to be delivered to all such capturing processes, instead of only once to such a
|
|
|
0a13d0 |
+fanout member. Naturally, each fanout member can have its own BPF filters attached.
|
|
|
0a13d0 |
+.PP
|
|
|
0a13d0 |
+.SS -K <hash|lb|cpu|rnd|roll|qm>, --fanout-type <hash|lb|cpu|rnd|roll|qm>
|
|
|
0a13d0 |
+This parameter specifies the fanout discipline, in other words, how the captured
|
|
|
0a13d0 |
+network traffic is dispatched to the fanout group members. Options are to distribute
|
|
|
0a13d0 |
+traffic by the packet hash (\[lq]hash\[rq]), in a round-robin manner (\[lq]lb\[rq]),
|
|
|
0a13d0 |
+by CPU the packet arrived on (\[lq]cpu\[rq]), by random (\[lq]rnd\[rq]), by rolling
|
|
|
0a13d0 |
+over sockets (\[lq]roll\[rq]) which means if one socket's queue is full, we move on
|
|
|
0a13d0 |
+to the next one, or by NIC hardware queue mapping (\[lq]qm\[rq]).
|
|
|
0a13d0 |
+.PP
|
|
|
0a13d0 |
+.SS -L <defrag|roll>, --fanout-opts <defrag|roll>
|
|
|
0a13d0 |
+Defines some auxillary fanout options to be used in addition to a given fanout type.
|
|
|
0a13d0 |
+These options apply to any fanout type. In case of \[lq]defrag\[rq], the kernel is
|
|
|
0a13d0 |
+being told to defragment packets before delivering to user space, and \[lq]roll\[rq]
|
|
|
0a13d0 |
+provides the same roll-over option as the \[lq]roll\[rq] fanout type, so that on any
|
|
|
0a13d0 |
+different fanout type being used (e.g. \[lq]qm\[rq]) the socket may temporarily roll
|
|
|
0a13d0 |
+over to the next fanout group member in case the original one's queue is full.
|
|
|
0a13d0 |
+.PP
|
|
|
0a13d0 |
.SS -f, --filter <bpf-file|expr>
|
|
|
0a13d0 |
Specifies to not dump all traffic, but to filter the network packet haystack.
|
|
|
0a13d0 |
As a filter, either a bpfc(8) compiled file can be passed as a parameter or
|
|
|
0a13d0 |
--
|
|
|
0a13d0 |
2.5.5
|
|
|
0a13d0 |
|