google / gopacket

Provides packet processing capabilities for Go
BSD 3-Clause "New" or "Revised" License
6.32k stars 1.13k forks source link

Packets loss trying to process SIP traffic #751

Closed fcerini closed 4 years ago

fcerini commented 4 years ago

Hi, Im trying to process SIP traffic. The problem is that when the time difference between packets is less than 1 millisecond I lost the second packet. There are not much packets per second, but often there are several packets almost at the same time. EXAMPLE 2020-01-23 15:18:37.242669874 SIP/2.0 200 OK From: "1003"sip:1003@172.24.131.236:5060;tag=417857592 ...

2020-01-23 15:18:37.242701932 LOST REGISTER sip:172.24.131.236:5060 SIP/2.0 ...

This is part of my code: ` // pcap

handle, err = pcap.OpenLive(device, snaplen, promisc, pcap.BlockForever)
if err != nil {
    log.Fatal(err)
}
defer handle.Close()

// Set filter
var filter string = conf.Filter
err = handle.SetBPFFilter(filter)
if err != nil {
    log.Fatal(err)
}

packetSource := gopacket.NewPacketSource(handle, handle.LinkType())
//  for packet := range packetSource.Packets() {
//      udpQueue <- packet
//  }

for {
    packet, err := packetSource.NextPacket()
    if err == io.EOF {
        break
    } else if err != nil {
        fmt.Println("ERROR: ", err)
        continue
    }

    //se procesan FIFO desde udpQueueConsumer
    udpQueue <- packet
}

`

I also tried afpacket with similar results...

` // afpacket afpacketHandle, err := newAfpacketHandle(iface, szFrame, szBlock, numBlocks, addVLAN, pcap.BlockForever) ...... source := gopacket.ZeroCopyPacketDataSource(afpacketHandle) defer afpacketHandle.Close()

for ; count != 0; count-- {
    data, _, err := source.ZeroCopyReadPacketData()
    if err != nil {
        log.Fatal(err)
    }

    ......

}

`

Thanks in advance Best Regards

fcerini commented 4 years ago

OK, i guess i will have to capture the sip traffic from C with pcap and forward the packets to GO somehow... Maybe UDP?

hdm commented 4 years ago

It sounds like the issue may be processing speed in your handler, not the read layer. Packets are likely being dropped while your handler is doing things to each packet.

Things you can try: 1) Dumping the packets into a buffered channel 2) Using multiple readers to process an unbuffered channel 3) Buffer into a file system queue and process in batches

fcerini commented 4 years ago

You are right, my channel is not buffered...