Re: RFC: a loadable plugin framework for external capture backends

[Stephen Hemminger via tcpdump-workers <tcpdump-workers () lists tcpdump org>]

> --- Begin Message ---
>
>
> From: Stephen Hemminger <stephen () networkplumber org>
>
> Date: Thu, 1 Oct 2026 15:50:20 -0700
>
> On Fri, 2 Oct 2026 00:45:15 +0300
> Vadim Goncharov <vadimnuclight () gmail com> wrote:
>
> > On Thu, 01 Oct 2026 16:33:58 -0400
> > Michael Richardson <mcr () sandelman ca> wrote:
> >
> > > Robin Jarry via tcpdump-workers <tcpdump-workers () lists tcpdump org> wrote:  
> > >     > Jardin, the author of the PR, and Robin Jarry) are jointly moving the
> > >     > discussion of a libpcap plugin framework here, to the mailing list, as
> > >     >    
> > >
> > > So, I want to distinguish between a **plugin** vs a stable API/ABI that DPDK,
> > > VPP, etc. could work against.  Or a stable ABI that libpcap could work
> > > against.  
> >
> > +1
> >
> > > (I also have many unpritable opinions about the OpenSSL provider interfaces)  
> >
> > +1
> >  
> > > So, let me suggest different interfaces which are relatively stable, and are
> > > already shared memory based: TPACKET_V3 and AF_XDP:
> > >   https://www.kernel.org/doc/html/latest/networking/af_xdp.html
> > >
> > > I recognize that these are two different but very similiar things, and I am
> > > unclear to what extent the Linux kernel treats them in similiar code paths.
> > > I believe that VPP, DPDK, etc. use AF_XDP to get packets from the kernel,
> > > and send them back to the device.  (I think that there are also still vendor
> > > proprietary paths?)  
> >
> > No, DPDK works in completely different way. An interface is detached from
> > kernel, it's DMA buffers are allocated inside huge pages (non-swappable),
> > driver (userland one!) places packets directly there, and main infinite loop
> > on each logical core polls that buffers eating 100% CPU even if there is no
> > traffic. That is, network interface disappears from system so there is nothing
> > to put into `tcpdump -i` - that's why entire subject is raised.
>
>
> I will cover these in detail at SharkFest Europe talk at the end of the month.
>
> --- End Message ---
_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s