You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
OMG I shoulda done this months ago! I do not understand why there exists AF_PACKET and PF_RING... they are essentially equivalent but AF_PACKET is merged in the mainline kernel whereas PF_RING has a cult following of people who like to patch their kernels.
AF_PACKET has a flow collision hash ring for dispatching packets to the fanout group members. it is perfect for the honeybadger usage. honeybadger will spawn N sniffer goroutines which will become members of the same fanout group. each member then receives it's slice of the flow hash ring worth of connections! perfect. muhahaha!
The text was updated successfully, but these errors were encountered:
IP fragmentation causes packets from the same flow to have different flow hashes. The flag PACKET_FANOUT_FLAG_DEFRAG, if set, causes packets to be defragmented before fanout is applied, to preserve order even in this case.
Let's evaluate how much work this feature addition will be so that we can properly prioritize this feature addition. It may well be the easiest path for honeybadger to approach fairly high line speeds.
The next step is to test this dev branch. I should probably ask people to help me test this.
We should perform two kinds of tests:
correctness
In my last commit that I changed the fanout type from afpacket.FanoutHash to afpacket.FanoutHashWithDefrag. That's because my brief cursory testing concluded that with afpacket.FanoutHash IPv6 was captured correctly and IPv4 packets were NOT properly captured but I didn't dig any further than that.
speed (bytes/packets per second processed)
How fast is honeybadger if we run multiple procs in a fanout hash ring?
I'm sure there are speed improvements to be made, but before we start to optimize for speed we need to benchmark the current performance to understand which changes make improvements.
OMG I shoulda done this months ago! I do not understand why there exists AF_PACKET and PF_RING... they are essentially equivalent but AF_PACKET is merged in the mainline kernel whereas PF_RING has a cult following of people who like to patch their kernels.
AF_PACKET has a flow collision hash ring for dispatching packets to the fanout group members. it is perfect for the honeybadger usage. honeybadger will spawn N sniffer goroutines which will become members of the same fanout group. each member then receives it's slice of the flow hash ring worth of connections! perfect. muhahaha!
The text was updated successfully, but these errors were encountered: