search

robertdavidgraham / masscan

TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes.
GNU Affero General Public License v3.0
22.95k stars 3.02k forks source link

PF_RING Alternative #766

Open APT-ZERO opened 4 months ago

APT-ZERO commented 4 months ago

Hi, this PF_RING supports no interface. Is there any alternative? are them supported?

APT-ZERO commented 4 months ago

Seems like there is multiple similar engines https://github.com/pavel-odintsov/fastnetmon?tab=readme-ov-file#supported-packet-capture-engines

mzpqnxow commented 3 weeks ago

Seems like there is multiple similar engines

https://github.com/pavel-odintsov/fastnetmon?tab=readme-ov-file#supported-packet-capture-engines

Based on my experience spending several weeks porting masscan to use the infiniband verbs interface (to support Mellanox NICs) my assessment is that though this can be done, it's non-trivial, if not outright painful, and requires a lot of "free" time- literally and figuratively

I don't expect support for any other zero-copy (or reduced interrupt) frameworks to be added any time soon, if ever. It's as simple as the fact that there are very few people that have the combination of time+interest+expertise

I would love to see this, it's just a lot of work. And for those who need to use the tool professionally, or even as hobbyists, it's very easy to get hardware with e1000 or i210 at the least

So yeah...

... but I'm not holding my breath for these, and I don't recommend you do either 😃