[Bro-Dev] [JIRA] (BIT-1363) Clustered AF_PACKET support

[Michal Purzynski (JIRA)]

    [ https://bro-tracker.atlassian.net/browse/BIT-1363?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=22006#comment-22006 ] 

Michal Purzynski commented on BIT-1363:
---------------------------------------

Last part, just in case I've followed the kernel code. The function that calculates hash of incoming packet is wrapper into many others, but in the very end, this piece of code gets called.

static inline u32 __flow_hash_from_keys(struct flow_keys *keys)
{
    u32 hash;

    /* get a consistent hash (same value on both flow directions) */

    if (((__force u32)keys->dst < (__force u32)keys->src) ||
        (((__force u32)keys->dst == (__force u32)keys->src) &&
         ((__force u16)keys->port16[1] < (__force u16)keys->port16[0]))) {
        swap(keys->dst, keys->src);
        swap(keys->port16[0], keys->port16[1]);
    }

    hash = __flow_hash_3words((__force u32)keys->dst,
                  (__force u32)keys->src,
                  (__force u32)keys->ports);
    if (!hash)
        hash = 1;

    return hash;
}


> Clustered AF_PACKET support
> ---------------------------
>
>                 Key: BIT-1363
>                 URL: https://bro-tracker.atlassian.net/browse/BIT-1363
>             Project: Bro Issue Tracker
>          Issue Type: New Feature
>          Components: Bro
>    Affects Versions: git/master
>            Reporter: Michal Purzynski
>
> Let's have a support for packet capture with the AF_PACKET sockets in multi worker configuration.
> Bro can use a single worker with af_packet, I have tested and it works, but having a direct support for multi-worker load balancing would allow to avoid the pf_ring for many deployments with the traffic level where DNA / ZC / Myricom / DAG is not required.



--
This message was sent by Atlassian JIRA
(v7.0.0-OD-04-018#70102)