search

draios / sysdig

Linux system exploration and troubleshooting tool with first class support for containers
http://www.sysdig.com/
Other
7.67k stars 728 forks source link

What about PF_RING aware fast network analyzer subsystem? #153

Open pavel-odintsov opened 10 years ago

pavel-odintsov commented 10 years ago

Hello!

I'm very excited about sysdig! It's very useful and compex (in good way) tool. You will replace almost all linux tools.

But what about hight performance network analyzer for replacing old and tcpdump? I tried to create fast network analyzer based on PF_RING and all works fine

gianlucaborello commented 10 years ago

Hi,

Thanks for liking sysdig.

We definitely are planning a tighter integration with the networking subsystem in order to correlate system and network events, not necessarily to replace tcpdump which is a very good tool, but more like to provide a unified filtering context for the user.

As far as the implementation goes, there are two ways to do it: one is to gather statistics by looking at the packets using a pcap-like interface (like you did in your project), and the other one is to use kernel tracepoints in the networking subsystem, so the implementation will likely use one or the other.

github-actions[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.