Messages in this thread | | | Date | Fri, 30 Aug 2019 12:43:19 +0300 | From | Ido Schimmel <> | Subject | Re: [PATCH v3 1/2] net: core: Notify on changes to dev->promiscuity. |
| |
On Thu, Aug 29, 2019 at 03:12:01PM -0700, David Miller wrote: > From: Ido Schimmel <idosch@idosch.org> > Date: Thu, 29 Aug 2019 22:36:13 +0300 > > > I fully agree that we should make it easy for users to capture offloaded > > traffic, which is why I suggested patching libpcap. Add a flag to > > capable netdevs that tells libpcap that in order to capture all the > > traffic from this interface it needs to add a tc filter with a trap > > action. That way zero familiarity with tc is required from users. > > Why not just make setting promisc mode on the device do this rather than > require all of this tc indirection nonsense? > > That's the whole point of this conversation I thought?
As I understand it, the goal of this series is to be able to capture offloaded traffic.
Currently, the only indication that drivers get when someone is running tcpdump/tshark/whatever over an interface is that it's is put in promisc mode. So this patches use it as an indication to trap all the traffic to the CPU and special case the bridge in order to prevent the driver from trapping packets when its ports are bridged. The same will have to be done for OVS and in any other (current or future) cases where promisc mode is needed to disable Rx filtering.
If there was another indication that these applications are running over an interface, would we be bothering with this new interpretation of promisc mode and special casing? I don't think so.
We can instead teach libpcap that in order to capture offloaded traffic it should use this "tc indirection nonsense". Or turn on a new knob. This avoids the need to change each driver with this new special case logic.
Also, what happens when I'm running these application without putting the interface in promisc mode? On an offloaded interface I would not be able to even capture packets addressed to my interface's MAC address. What happens when the interface is already in promisc mode (because of the bridge) and I'm again running tcpdump with '-p'? I will not be able to capture offloaded traffic despite the fact that the interface is already configured in promisc mode.
| |