Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Migrate to pcap on the datalink layer #157

Closed

Conversation

TheLostLambda
Copy link
Collaborator

Fixes (probably) #136

There were some wild bugs lurking here... As it turns out, my problem (and I suspect the problem others have been having) is related to a relatively obscure and poorly documented hardware feature of modern network cards: offloading. In my particular case, generic receive offload (gro) is what led to netmap (a backend of the pnet backend of Bandwhich) dropping packets for being too large (because gro merges many packets before passing them to the operating system).

The first solution was turning off this feature and related "offload" features using ethtool:

# ethtool -K eth0 tx off rx off gso off tso off gro off lro off

Obviously though, that's a hacky workaround and other programs are able to read these packets correctly! As it turns out, pnet has many available backends, so I gave a couple a try. Unfortunately the linux backend had the same issue as netmap, but luckily, the pcap backend could gracefully handle these merged packets!

I needed to enable the pcap feature of pnet, but now things are reporting correctly for both upload and download (for me at least)!

@imsnif
Copy link
Owner

imsnif commented Mar 31, 2020

Alright @TheLostLambda, let's make this happen!
Do note though: this is an untested part of the code base. So we'll need to be extra careful.
I'll do some tests of this locally.

As for the build: I'll try to restart the travis job in case this was just a hiccup (been happening for me elsewhere lately as well), but otherwise - can you take a look and see if you can figure out what caused it not to compile in this case?

I'd also want to test this on a mac to see how it behaves there. @zhangxp1998 - if you have the time, would you be willing to give this branch a spin? We're trying to update the pnet backend to pcap to solve several inaccuracy issues.

@imsnif
Copy link
Owner

imsnif commented Mar 31, 2020

Build is still failing. Looks like it's missing the pcap dependency. I'm guessing we can add the package as a requirement to the build, but in that case I'm guessing it'll have to be added to all of our various dependency chains, wouldn't it?

@TheLostLambda
Copy link
Collaborator Author

Hmm, not certain. I suppose I already had libpcap installed. It's part of the base repo in Arch. How do we go about adding that packaged to Travis?

Unfortunately, I'm rather new to Travis and CI build systems.

@imsnif
Copy link
Owner

imsnif commented Mar 31, 2020

Looks like it: https://github.com/ebfull/pcap#linux

I'll admit I'm not thrilled about this, friend. Do you think there is another way to solve this issue? I don't want everyone who wants to install bandwhich to have to install a system dependency. We'd have to start maintaining a list of installation instructions for each platform, deal with various differences, peculiarities and such...

@TheLostLambda
Copy link
Collaborator Author

Hmm... I suppose that I could try to look into it a bit more. Perhaps there is a better way to handle this, but I'm not sure. it would involved changes to the underlying libraries. I suppose I'll give it a look.

@imsnif
Copy link
Owner

imsnif commented Mar 31, 2020

Thanks @TheLostLambda ! We already have a fork of a lot of pnet due to other issues. We can make changes there if need be or change things upstream if we find an issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants