PcapPlusPlus
|
#include <pthread.h>
#include <time.h>
#include "MacAddress.h"
#include "SystemUtils.h"
#include "RawPacket.h"
#include "PcapLiveDevice.h"
Go to the source code of this file.
Classes | |
class | pcpp::MBufRawPacket |
class | pcpp::PciAddress |
class | pcpp::DpdkDevice |
struct | pcpp::DpdkDevice::DpdkDeviceConfiguration |
struct | pcpp::DpdkDevice::LinkStatus |
struct | pcpp::DpdkDevice::RxTxStats |
struct | pcpp::DpdkDevice::DpdkDeviceStats |
Namespaces | |
pcpp | |
The main namespace for the PcapPlusPlus lib. | |
Typedefs | |
typedef void(* | pcpp::OnDpdkPacketsArriveCallback) (MBufRawPacket *packets, uint32_t numOfPackets, uint8_t threadId, DpdkDevice *device, void *userCookie) |
typedef PointerVector< MBufRawPacket > | pcpp::MBufRawPacketVector |
This file and DpdkDeviceList.h provide PcapPlusPlus C++ wrapper for DPDK (stands for data-plan development kit). What is DPDK? as quoting from http://dpdk.org: "DPDK is a set of libraries and drivers for fast packet processing... These libraries can be used to: receive and send packets within the minimum number of CPU cycles (usually less than 80 cycles)... develop fast packet capture algorithms (tcpdump-like)... run third-party fast path stacks... Some packet processing functions have been benchmarked up to hundreds million frames per second, using 64-byte packets with a PCIe NIC"
As DPDK API is written in C, PcapPlusPlus wraps the main functionality in a C++ easy-to-use classes which should have minimum affect on performance and packet processing rate. In addition it brings DPDK to the PcapPlusPlus framework and API so you can use DPDK together with other PcapPlusPlus features such as packet parsing and editing, etc.
So how DPDK basically works? in order to boost packet processing performance on a commodity server DPDK is bypassing the Linux kernel. All the packet processing activity happens in the user space so basically packets are delivered from NIC hardware queues directly to user-space shared memory without going through the kernel. In addition DPDK uses polling instead of handling interrupts for each arrived packet (as interrupts create some delays). Other methods to boost packets processing implemented by DPDK are using Hugepages to decrease the size of TLB that results in a much faster virtual to physical page conversion, thread affinity to bind threads to a specific core, lock-free user-space multi-core synchronization using rings data structures and NUMA awareness to avoid expensive data transfers between sockets.
Not every NIC supports kernel-bypass capabilities so DPDK cannot work with any NIC. The list of supported NICs are in DPDK's web-site http://dpdk.org/doc/nics . For each such NIC the DPDK framework provides a module that called poll-mode-driver (PMD in short) that enables this NIC to the working with DPDK. PcapPlusPlus wasn't tested with most PMDs but all of them should theoretically work as PcapPlusPlus doesn't change the PMD behavior
DPDK has another basic data-structure called mbuf. An mbuf is DPDK wrapper struct for network packets. When working with packets in DPDK you actually work with mbufs. The mbuf contains the packet data (obviously) but also some metadata on the packet such as the DPDK port it was captured on, packet ref-count (which allows it to be referenced by several objects), etc. One important concept is that DPDK doesn't allocate mbufs on-the-fly but uses mbuf pools. These pools is allocated on application startup and used throughout the application. The goal of this, of course, is increasing packet processing performance as allocating memory has its cost. So pool size is important and varies between applications. For example: an application that stores packets in memory has to have a large pool of mbufs so mbufs doesn't run-out. PcapPlusPlus enables to choose the pool size at startup
PcapPlusPlus main wrapper classes for DPDK are:
DPDK initialization using PcapPlusPlus: