Hi Lorenzo, On Sat, Feb 6, 2016 at 11:16 PM, Lorenzo Pistone <[email protected]> wrote: > Hi, I would like to suggest a feature. It would be nice to have an option to > capture a packet only once every N packets. I can see that one could > implement it by abusing the fanout-group feature (have one group, one > instance actually capturing and the others with a filter that exclude all > packets, and set the fanout-type to round-robin). I don't know if there's > any better way to implement it with low level API, but such hack may > nevertheless be implemented as an option. > > Cheers. > Lorenzo > > -- > You received this message because you are subscribed to the Google Groups > "netsniff-ng" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout.
Just FYI - Tobias will probably offline till end of this week, I am sure he will answer to you. I'd like to help you but I am not so technical good in AF_PACKET, but this feature sounds like a 'Packet sampling' feature ? At least it can be implemented for 1 process-only in the while(...) loop when reading mmap-ed frames from kernel by checking sniffed number of packets ? For the fan-out group processes it seems like it needs to check each N packet on the kernel side (eBPF might help ?) ? It would be good to hear comments from Daniel too :) Regards, Vadim Kochan -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
