pcap

Documentation

Index

• Variables
• func Collect(stop <-chan struct{}, intf string, bpfFilter string, bufferShare float32, ...) error
• func CreatePacket(src, dst net.IP, srcPort, dstPort int, payload []byte) gopacket.Packet
• func CreatePacketWithSeq(src, dst net.IP, srcPort, dstPort int, payload []byte, seq uint32) gopacket.Packet
• func CreateTCPSYN(src, dst net.IP, srcPort, dstPort int, seq uint32) gopacket.Packet
• func CreateTCPSYNAndACK(src, dst net.IP, srcPort, dstPort int, seq uint32) gopacket.Packet
• func CreateUDPPacket(src, dst net.IP, srcPort, dstPort int, payload []byte) gopacket.Packet
• type NetworkTrafficObserver
  • func CountTcpPackets(ifc string, packetCount trace.PacketCountConsumer) NetworkTrafficObserver
• type NetworkTrafficParser
  • func NewNetworkTrafficParser(bufferShare float32) *NetworkTrafficParser
  • func (p *NetworkTrafficParser) InstallObserver(observer NetworkTrafficObserver)
  • func (p *NetworkTrafficParser) ParseFromInterface(interfaceName, bpfFilter string, signalClose <-chan struct{}, ...) (<-chan akinet.ParsedNetworkTraffic, error)

Variables

var CountBadAssemblerContextType uint64

Number of times we got an assembler context of the wrong type; this probably shouldn't happen at all.

var CountNilAssemblerContext uint64

Nunmber of times we got a nil assembler context; this can happen when the payload resides in a page other than the first in the reassembly buffer.

var CountNilAssemblerContextAfterParse uint64

or when we flush old data?

var MaxBufferedPagesPerConnection int = 4_000

What is a reasonable worst case? We should have enough so that if the packet is retransmitted, we will get it before giving up. 10Gb/s networking * 1ms RTT = 1.25 MB = 1Gb/s networking * 10ms RTT We have observed 3GB growth in RSS over 40 seconds = 75MByte/s Assuming a very long 100ms RTT then we'd need 75MB/s * 100ms = 7.5 MB 7.5MB / 1900 bytes = 3947 pages This would permit only 37 connections to simultaneously stall; 1.5MB / 1900 bytes = 657 pages might be better. TODO: Would be interesting to know the TCP window sizes we see in practice and adjust that way.

var MaxBufferedPagesTotal int = 100_000

Maximum size of gopacket reassembly buffers, per interface and direction.

A gopacket page is 1900 bytes. We want to cap the total memory usage at about 200MB = 105263 pages

var (
	// TODO: packet capture timeouts are tuned using the packet capture tests on a
	// particular developer's machine. We should implement some autotuning logic
	// based on specific machine that the broker is running on.
	// https://app.clubhouse.io/akita-software/story/521
	PktCaptureWaitFlag = flag.Duration("packet_capture_wait_duration", 30*time.Millisecond, "Amount of time to wait after API calls complete before stopping packet capture. This has a direct impact on our API test throughput.")
)

var StreamCloseTimeoutSeconds int64 = 90

The maximum time we will leave a connection open waiting for traffic. 90 seconds is the longest possible that the upper layers can wait for a response before the request is uploaded before it. (But this might happen as soon as 60 seconds.)

var StreamTimeoutSeconds int64 = 10

The maximum time we will wait before flushing a connection and delivering the data even if there is a gap in the collected sequence.

Functions

func Collect

func Collect(
	stop <-chan struct{},
	intf string,
	bpfFilter string,
	bufferShare float32,
	parseTCPAndTLS bool,
	proc trace.Collector,
	packetCount trace.PacketCountConsumer,
	pool buffer_pool.BufferPool,
) error

func CreatePacket

func CreatePacket(src, dst net.IP, srcPort, dstPort int, payload []byte) gopacket.Packet

func CreatePacketWithSeq

func CreatePacketWithSeq(src, dst net.IP, srcPort, dstPort int, payload []byte, seq uint32) gopacket.Packet

func CreateTCPSYN

func CreateTCPSYN(src, dst net.IP, srcPort, dstPort int, seq uint32) gopacket.Packet

func CreateTCPSYNAndACK

func CreateTCPSYNAndACK(src, dst net.IP, srcPort, dstPort int, seq uint32) gopacket.Packet

func CreateUDPPacket

func CreateUDPPacket(src, dst net.IP, srcPort, dstPort int, payload []byte) gopacket.Packet

Types

type NetworkTrafficObserver

type NetworkTrafficObserver func(gopacket.Packet)

NetworkTrafficObserver is the callback function type for observing packets as they come in to a NetworkTrafficParser.

func CountTcpPackets

func CountTcpPackets(ifc string, packetCount trace.PacketCountConsumer) NetworkTrafficObserver

Observe every captured TCP segment here

type NetworkTrafficParser

type NetworkTrafficParser struct {
	// contains filtered or unexported fields
}

func NewNetworkTrafficParser

func NewNetworkTrafficParser(bufferShare float32) *NetworkTrafficParser

func (*NetworkTrafficParser) InstallObserver

func (p *NetworkTrafficParser) InstallObserver(observer NetworkTrafficObserver)

Replace the current per-packet callback. Should be called before starting ParseFromInterface.

func (*NetworkTrafficParser) ParseFromInterface

func (p *NetworkTrafficParser) ParseFromInterface(interfaceName, bpfFilter string, signalClose <-chan struct{}, fs ...akinet.TCPParserFactory) (<-chan akinet.ParsedNetworkTraffic, error)

Parses network traffic from an interface. This function will attempt to parse the traffic with the highest level of protocol details as possible. For instance, it will try to piece together HTTP request and response pairs. The order of parsers matters: earlier parsers will get tried first. Once a parser has been accepted, no other parser will be used.