On Sat, May 02, 2015 at 07:00:53PM +0200, Tobias Klauser wrote: > On 2015-04-29 at 21:18:24 +0200, Vadim Kochan <vadi...@gmail.com> wrote: > > From: Vadim Kochan <vadi...@gmail.com> > > > > It might be related to the issue #73 noticed by > > > > Jon Schipp <jonsch...@gmail.com> > > > > where he pointed that netsniff-ng captures some extra packets. > > > > I observed this issue when I captured few Ethernet frames from > > wireless device while I was sniffing Netlink monitor device (!!!), > > especially under high load traffic (HD Video). > > > > It can be easy grepped: > > > > sudo netsniff-ng/netsniff-ng -i nlmon0 --less | grep <dev> > > > > where <dev> is the active high traffic device. > > > > Interesting observation was that issue appeared only in the beginning of > > the sniffing, and after some investigation I came up to the conclusion > > that issue might be caused when netsniff-ng creates RX ring through the > > setsockopt where Linux registers device hook for any device (we did not > > bind yet socket to the specified device), and I assumed that before > > binding to the specified device Linux can caught for us some packets > > from the other devices until netsniff-ng will bind socket to the > > specified device. > > > > So fixed (I can't reproduce this anymore) by moving device binding > > before attaching RX ring to the socket, in this case setsockopt consider > > the bound device. > > > > Signed-off-by: Vadim Kochan <vadi...@gmail.com> > > --- > > ring_rx.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/ring_rx.c b/ring_rx.c > > index 32d3f6d..56685e0 100644 > > --- a/ring_rx.c > > +++ b/ring_rx.c > > @@ -231,10 +231,10 @@ void ring_rx_setup(struct ring *ring, int sock, > > size_t size, int ifindex, > > { > > fmemset(ring, 0, sizeof(*ring)); > > setup_rx_ring_layout(sock, ring, size, jumbo_support, v3); > > + bind_ring_generic(sock, ring, ifindex, false); > > create_rx_ring(sock, ring, verbose); > > mmap_ring_generic(sock, ring); > > alloc_rx_ring_frames(sock, ring); > > - bind_ring_generic(sock, ring, ifindex, false); > > join_fanout_group(sock, fanout_group, fanout_type); > > prepare_polling(sock, poll); > > Shouldn't mmap_ring_generic and alloc_rx_ring_frames be done before > bind_ring_generic? How about moving create_rx_ring down instead of > moving bind_ring_generic up? > > Daniel can probably comment better on how exactly the order should be > and what the interdependecies are... Any comments?
My understanding is, that bind-ing in this case is just re-registering packet hook to the specified device. What would be a difference if after pf_alloc socket already has a default packet hook which is bound to all devices and any protocol ? Sure, Daniel's comments would great to have here :-) -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to netsniff-ng+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.