Re: [pmacct-discussion] pcap/ulog performance on Linux

[Paolo Lucente]

Hi Vincent,

Inline:

On Tue, Mar 01, 2016 at 11:06:39AM +0100, Vincent Bernat wrote:

> > Can I add it through the use of libnetfilter-log? Or do you want it
> > without any external dependencies? I already did a couple of daemons
> > with libnetfilter-log.

First off, it would be wonderful if you would like to pick this up; by
reading a bit, libnetfilter-log seems definitely the way to go. So i'm
with you on this.

> And a related question, should the added support be in addition to ULOG
> or replace it? If replace it, would it be inside the uacctd daemon or a
> separate nflacctd daemon?
> 
> My preferences are ordered like this:
> 
>  1. replace ULOG support by NFLOG support
>  2. add NFLOG support inside uacctd daemon
>  3. use a separate nflacctd daemon

Ack all & i'm with you on option #1 since we are also in a new release,
1.6, and we can break backwards compatibility for the good.

Cheers,
Paolo


___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Re: [pmacct-discussion] pcap/ulog performance on Linux

[Vincent Bernat]

 ❦ 29 février 2016 19:30 +0100, Vincent Bernat  :

>> You are right with your assumption. Support of NFLOG has been requested,
>> ie. to support IPv6, but is still pending and i don't have it currently
>> on my radar (ie. 1.6.0 / 1.6.1). 
>
> Can I add it through the use of libnetfilter-log? Or do you want it
> without any external dependencies? I already did a couple of daemons
> with libnetfilter-log.

And a related question, should the added support be in addition to ULOG
or replace it? If replace it, would it be inside the uacctd daemon or a
separate nflacctd daemon?

My preferences are ordered like this:

 1. replace ULOG support by NFLOG support
 2. add NFLOG support inside uacctd daemon
 3. use a separate nflacctd daemon

-- 
Use debugging compilers.
- The Elements of Programming Style (Kernighan & Plauger)

___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Re: [pmacct-discussion] pcap/ulog performance on Linux

[Vincent Bernat]

 ❦ 29 février 2016 18:12 GMT, Paolo Lucente  :

> You are right with your assumption. Support of NFLOG has been requested,
> ie. to support IPv6, but is still pending and i don't have it currently
> on my radar (ie. 1.6.0 / 1.6.1). 

Can I add it through the use of libnetfilter-log? Or do you want it
without any external dependencies? I already did a couple of daemons
with libnetfilter-log.
-- 
Lay on, MacDuff, and curs'd be him who first cries, "Hold, enough!".
-- Shakespeare

___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Re: [pmacct-discussion] pcap/ulog performance on Linux

[Paolo Lucente]

Hi Vincent,

You are right with your assumption. Support of NFLOG has been requested,
ie. to support IPv6, but is still pending and i don't have it currently
on my radar (ie. 1.6.0 / 1.6.1). 

Cheers,
Paolo

On Mon, Feb 29, 2016 at 05:55:51PM +0100, Vincent Bernat wrote:
>  ??? 26 f??vrier 2016 17:53 +0100, Vincent Bernat ??:
> 
> > Has someone already done some simple benchmarks to check the performance
> > of libpcap-based capture with libpcap >= 1.0.0 (mmap support) and Linux
> > kernel >= 2.6.27 (64bit support). There is another milestone which is
> > libpcap >= 1.5 and Linux kernel >= 3.10 (support for TPACKET_V3)?
> >
> > How would this compare with the performance with ULOG?
> 
> I did try to use uacctd. It seems that it is unable to receive what I
> send over NFLOG. Am I correct to assume that it supports only ULOG
> (despite the NETLINK_NFLOG mention in the source code)? All other
> NFLOG-enabled programs are using libnetlink-log library which configures
> everything over netlink instead of with bind/setsockopt.
> -- 
> Grief can take care of itself; but to get the full value of a joy you must
> have somebody to divide it with.
>   -- Mark Twain
> 
> ___
> pmacct-discussion mailing list
> http://www.pmacct.net/#mailinglists

___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

Re: [pmacct-discussion] pcap/ulog performance on Linux

[Vincent Bernat]

 ❦ 26 février 2016 17:53 +0100, Vincent Bernat  :

> Has someone already done some simple benchmarks to check the performance
> of libpcap-based capture with libpcap >= 1.0.0 (mmap support) and Linux
> kernel >= 2.6.27 (64bit support). There is another milestone which is
> libpcap >= 1.5 and Linux kernel >= 3.10 (support for TPACKET_V3)?
>
> How would this compare with the performance with ULOG?

I did try to use uacctd. It seems that it is unable to receive what I
send over NFLOG. Am I correct to assume that it supports only ULOG
(despite the NETLINK_NFLOG mention in the source code)? All other
NFLOG-enabled programs are using libnetlink-log library which configures
everything over netlink instead of with bind/setsockopt.
-- 
Grief can take care of itself; but to get the full value of a joy you must
have somebody to divide it with.
-- Mark Twain

___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists

[pmacct-discussion] pcap/ulog performance on Linux

[Vincent Bernat]

Hey!

Has someone already done some simple benchmarks to check the performance
of libpcap-based capture with libpcap >= 1.0.0 (mmap support) and Linux
kernel >= 2.6.27 (64bit support). There is another milestone which is
libpcap >= 1.5 and Linux kernel >= 3.10 (support for TPACKET_V3)?

How would this compare with the performance with ULOG?
-- 
Choose a data representation that makes the program simple.
- The Elements of Programming Style (Kernighan & Plauger)

___
pmacct-discussion mailing list
http://www.pmacct.net/#mailinglists