Re: [Pandora] Component::notify()

[Simon Patarin]

> I think this will not work, because you need SYN, SYN+ACK and the final ACK,
> you need to stablish an state for the connection, so IMHO it must to be put
> after the demux.
>
> please note that I'm interested in making possible putting the monitor in
> the middle of the network, not "just" in the edge

I've never imagined anything else! pandora was originally designed to be
"in the middle" (at the border router of some organization for example),
but I have completely overlooked the fact that there were an ACK without
the SYN flag set. Then, yes, you're right, it's much better after the
demux (actually, that's the only place where it could be).

> Also, I'm not just interested in the 3WHS, but also in a few more packets
> that lets to calculate other RTT measurement.

Then I think that your best choice is to design a component (the
"mycomponent" after the demux) that will discard unnecessary packets by
itself. I do not know how many packets you are likely to handle and on
which kind of hardware, but on a pentium-III 1 GHz, it costs 0.1
microsecond for a packet to flow through a component, if you add 0.4 more
for the lookup in the map, it should not be too much a burden (0.5
microsecond per packet) to discard packets directly in your component
(at 40000 pkts/s this makes about 2% cpu) rather than early in the
demux.

> my reference is:

??
It looks like the mailing-list is eating some lines!

> maybe I should go to bed right now, but I think tcpsynfilter must
> mantain some state in a per connection basis, so it's not that easy
> becuase of putting the monitor in the middle....

No, no, it's me who should go to bed! (even if I do not feel like it right
now)

Simon