Re: Legacy Linux kernel support

[Mario Rugiero via tcpdump-workers <tcpdump-workers () lists tcpdump org>]

> --- Begin Message ---
>
>
> From: Mario Rugiero <mrugiero () gmail com>
>
> Date: Tue, 22 Oct 2019 17:22:39 -0300
>
> El mar., 22 oct. 2019 a las 16:02, Guy Harris (<gharris () sonic net>) escribió:
> > I.e., the goal for libpcap support on Linux should be something such as
> >
> >         it should work on min({kernel for oldest supported enterprise distribution}, {oldest "longterm maintenance" 
> > kernel release from kernel.org})
> I'm more inclined to oldest longterm from kernel.org only, but I guess so.
>
> > OK, so TPACKET_V3 currently supports something similar to what BPF devices support, i.e. "deliver a block if it's 
> > full or if the timeout expires".  The timeout is in the tp_retire_blk_tov field of a tpacket_req3 structure, as 
> > handed to a SOL_PACKET/PACKET_RX_RING setsockopt() call.  It's in units of milliseconds; it doesn't refer to 
> > inter-packet spacing, but to the age of the block.
> >
> > Currently it doesn't deliver empty blocks; libpcap can handle either "delivers empty blocks" (as that's what BPF 
> > devices do) or "doesn't deliver empty blocks" (as that's what TPACKET_V3 currently does).
> >
> > The main difference is whether the timeout times out even if no packets are available; I guess code that wants to be 
> > woken up periodically, perhaps to do other work, even if there's no traffic that passes the filter would prefer "time 
> > out even if no packets are available".
> I see. We would want a way to signal we want time outs regardless of
> blocks being empty, then, right?
>
> > OK, I guess I'll have to go back to reading that list.  (It's a very heavy traffic list, and 99.99999999999% of it 
> > isn't relevant to packet capture - all that matters to me is 1) PF_PACKET stuff and 2) stuff involving device modes 
> > such as some ethtool features and monitor-mode/radiotap support - so I just look at it on occasion.)
> Wouldn't CC'ing you keep you on the loop already?
>
> > I.e., getifaddr() will find interfaces with no networking-layer addresses (no IPv4/IPv6/etc.) on 2.4 and later 
> > kernels?
> Exactly. There's even a code sample showing this in the Linux manual.
>
> --- End Message ---
_______________________________________________
tcpdump-workers mailing list
tcpdump-workers () lists tcpdump org
https://lists.sandelman.ca/mailman/listinfo/tcpdump-workers