tcpdump mailing list archives

Re: RFC: a loadable plugin framework for external capture backends


From: Michael Richardson <mcr () sandelman ca>
Date: Fri, 02 Oct 2026 10:10:34 -0400


Robin Jarry <rjarry () redhat com> wrote:
    >>> - Off by default. The loader should be a compile-time option,   disabled
    >>> by default, as fxlb already requested on the PR.   Distributions and
    >>> dataplane projects opt in; a stock libpcap build   carries none of it.
    >>
    >> Given this, does the plugin actually need to be loadable?

    > What do you mean?

If the loader is off by default, and the end-user uas to recompile libpcap
to enable plugins,  (and the plugin has to be compiled),  then why do we need it dynamic?

If someone (redhat, ubuntu, ...) are shipping DPDK-enabled distros with some
application (OVS, whatever), then you'd build libpcap that way there.
It's what ships as libpcap in RHEL, U-server LTS 26, ... that concerns us.
(and... it's not just the actual bugs anymore, it's the slop that might get
triggered...)

    >> Alternatively: fork libpcap, rip EVERYTHING else out ("git rm", not
    >> edits). Leave that as one or two commits with the right code, and just
    >> rebase that on libpcap.git. Maybe we'd even accept that as a continuing
    >> branch.

    > I'll take that as a trolling attempt :)

    > Obviously, the goal of my email was to *avoid* forking. Besides, I don't
    > think my employer would be thrilled if we did!

Forking is no longer such a bad word since git.
This isn't that different than maintaining a plugin PR for a release cycle.

    >> The best way to amortize and test the cost of the ABI is for libpcap to use
    >> that ABI to do, for instance TPACKET_V3.   This might let us remove some of
    >> the TPACKET3 bug-work around code by having an "older" plugin. We have lots
    >> of #ifdef HAVE_LIBNL around nl80211 code, and maybe that could be a plugin.
    >> Maybe we could drop TPACKET_V2, although that might not be much of a win.

    > That rejoins what Bill was proposing: change builtin backends to use that
    > plugin API. That way, it will be tested.

I am for the above, but I thought Bill was proposing that pcap.h was the API.

--
]               Never tell me the odds!                 | ipv6 mesh networks [
]   Michael Richardson, Sandelman Software Works        |    IoT architect   [
]     mcr () sandelman ca  http://www.sandelman.ca/        |   ruby on rails    [
]       My working hours and your working hours may be different.            [
]  Please do not feel obligated to reply outside your normal working hours   [

_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s

Current thread: