On 02/18/2016 12:09 PM, Vadim Kochan wrote:
Hi Lorenzo,
On Sat, Feb 6, 2016 at 11:16 PM, Lorenzo Pistone <blaffabla...@gmail.com> wrote:
Hi, I would like to suggest a feature. It would be nice to have an option to
capture a packet only once every N packets. I can see that one could
implement it by abusing the fanout-group feature (have one group, one
instance actually capturing and the others with a filter that exclude all
packets, and set the fanout-type to round-robin). I don't know if there's
any better way to implement it with low level API, but such hack may
nevertheless be implemented as an option.
Doing this through round-robin seems not efficient to me.
You can easily write a cBPF (e.g. bpf_asm) or eBPF filter with random packet
sampling, so you only get a fraction of your traffic into AF_PACKET.
Cheers.
Lorenzo
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an
email to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
Just FYI - Tobias will probably offline till end of this week, I am
sure he will answer to you.
I'd like to help you but I am not so technical good in AF_PACKET, but
this feature sounds like a 'Packet sampling' feature ?
At least it can be implemented for 1 process-only in the while(...)
loop when reading mmap-ed frames from kernel by checking
sniffed number of packets ? For the fan-out group processes it seems
like it needs to check each N packet on the kernel side (eBPF might
help ?) ?
It would be good to hear comments from Daniel too :)
Regards,
Vadim Kochan
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to netsniff-ng+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
