[Qemu-devel] Re: [PATCH RFC 0/4] Dumping traffic when using netdev devices

[Anthony Liguori]

On 07/15/2010 03:22 PM, Miguel Di Ciurcio Filho wrote:
> Hello,
>
> This is a prototype suggestion. I mostly copied and pasted the code from
> net/dump.c into net.c and made some adjustments. There is no command line
> parsing involved yet, just the internals and small changes in net/tap.c and
> net/slirp.c do make the thing work.
>
> In my tests, using tap as backend, e1000 as a guest device and running iperf 
> from
> guest to host, the overhead of dumping the traffic caused a loss of around 30%
> of performance.
>
> I opened the dumped files in wireshark and they looked fine. When using slirp
> all requests were dumped fine too.
>    

A less invasive way to do this would be to chain netdev devices.

Basically:

-netdev tap,fd=X,id=foo
-netdev dump,file=foo.pcap,netdev=foo,id=bar
-net nic,model=virtio,netdev=bar

I think this has some clear advantages to this architecturally.  From a 
user perspective, the only loss is that you have to add the dump device 
at startup (you can still enable/disable capture dynamically).

Regards,

Anthony Liguori

> Bugs/limitations:
> - I have no clue on how to deal with tap+vhost, is it necessary?
> - When using virtio-net, I'm not sure how to handle iovec when vnet_hdr=on
> - Create a function to add dump to a netdev on the fly, is it necessary?
> - Handle cleanups
>
> Miguel Di Ciurcio Filho (4):
>    net/dump: Make pcap structures public
>    net: Introduce NetClientDump and auxiliary functions
>    net/tap: Suggested support for NetClientDump
>    net/slirp: Suggested support for NetClientDump
>
>   net.c         |   90 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
>   net.h         |    8 +++++
>   net/dump.c    |   21 -------------
>   net/dump.h    |   21 +++++++++++++
>   net/slirp.c   |    3 ++
>   net/tap.c     |    3 ++
>   qemu-common.h |    1 +
>   7 files changed, 126 insertions(+), 21 deletions(-)
>
>