search

IETF-OPSAWG-WG / draft-ietf-opsawg-pcap

PCAP next generation file format specification
Other
263 stars 59 forks source link

Use 3 bits in EPB epb_flags option for GSO_TCP and Csum metadata #144

Closed lxin closed 8 months ago

lxin commented 9 months ago

Csum NotReady, Csum Valid and GSO_TCP are 3 flags from the tp_status in PACKET socket when capturing packets from kernel:

TP_STATUS_CSUMNOTREADY TP_STATUS_VLAN_VALID TP_STATUS_GSO_TCP

See each description in the patch.

These are important flags when parsing the packets, and this patch adds them into epb_flags by using its reserved 3 bits.

Note that GSO_TCP flag provides a more reliable way to parse BIG TCP packets than currently using 'guessing' TSO for such packets in tcpdump and wireshark.

guyharris commented 9 months ago

An option containing flag bits could also be added to the Interface Description Block, with flag bits indicating that the interface supports TCP desegmentation when receiving, TCP segmentation when transmitting, generating IP checksums when transmitting, checking IP checksums when receiving, generating TCP checksums when transmitting, checking TCP checksums when receiving, generating UDP checksums when transmitting, and checking UDP checksums when receiving. This could support environments that don't provide per-packet indicating of whether segmentation/desegmentation has been done, whether the checksum was handled by the adapter, etc..

lxin commented 9 months ago

An option containing flag bits could also be added to the Interface Description Block, with flag bits indicating that the interface supports TCP desegmentation when receiving, TCP segmentation when transmitting, generating IP checksums when transmitting, checking IP checksums when receiving, generating TCP checksums when transmitting, checking TCP checksums when receiving, generating UDP checksums when transmitting, and checking UDP checksums when receiving. This could support environments that don't provide per-packet indicating of whether segmentation/desegmentation has been done, whether the checksum was handled by the adapter, etc..

These interface features are configurable by ethtool in linux without even bringing down the interfaces, like disabling tcp-segmentation-offload:

# ethtool -K eth0 tcp-segmentation-offload off

As IDB is not per packet, I think we can't assume all packets were captured with the same features on this interface.