Re: RFC: a loadable plugin framework for external capture backends

[Robin Jarry via tcpdump-workers <tcpdump-workers () lists tcpdump org>]

> --- Begin Message ---
>
>
> From: "Robin Jarry" <rjarry () redhat com>
>
> Date: Sun, 04 Oct 2026 11:11:44 +0200
>
> Hi Guy,
>
> First of all, I need to clarify one thing: DPDK is *not* an application. 
> It is a low-level collection of hardware drivers and libraries. And more 
> important: Applications using DPDK (OVS, VPP, grout, etc.) do *not* have 
> the same representation for what is an interface. DPDK only provides 
> abstractions for what is an Ethernet device.
>
> Any attempt at making a *generic* capture API in DPDK libraries will 
> only work on physical ports. You will not be able to capture traffic on 
> logical interfaces (e.g. VLAN, VXLAN, IPIP, GRE, etc.) as these are 
> logical constructs that only make sense in the context of each 
> application.
>
> Guy Harris, Oct 03, 2026 at 21:15:
> > At least as I understand Michael's proposal, I'm not sure to what 
> > extent it differs from many of the existing built-in modules.
> >
> > For example, the D-Bus sniffing support requires that the dbus-1 
> > package be installed, so it can link with that library. The configure 
> > script and CMakeLists.txt check whether it's present and, if so, 
> > configures libpcap to link with it and defines PCAP_SUPPORT_DBUS.
>
> The premise for this is that libpcap is aware of such backends *in 
> advance*.
>
>         pcap.c:118:#ifdef PCAP_SUPPORT_DBUS
>         pcap.c:119:#include "pcap-dbus.h"
>
> This is the very thing our proposal wants to avoid.
>
> > As I understand it, Michael's proposal would, to use DPDK as an 
> > example, check whether a "DPDK libpcap support" library, which 
> > provides findalldevs and create routines, is installed, and, if so, 
> > configures libpcap to link with it and defines PCAP_SUPPORT_DPDK.
>
> > The only difference I see there is that the code that uses the D-Bus 
> > library to support capturing is currently part of libpcap, although, 
> > with the scheme in question, perhaps the D-Bus developers should take 
> > that over.
>
> Reflecting back on my first paragraphs: PCAP_SUPPORT_DPDK would not make 
> any sense if you want to capture traffic from DPDK-enabled applications. 
> It would only be a PoC demonstration like the one I removed before 
> 0.11.0. Nothing you could use in real-world applications.
>
> You would need PCAP_SUPPORT_GROUT, PCAP_SUPPORT_OVS, PCAP_SUPPORT_VPP, 
> etc. And you would be right where we started before removing DPDK 
> support, only worse. Each application would need to add their backend 
> code in the libpcap repository and maintain it every time their API 
> changes. This would impose additional maintenance on libpcap and/or 
> forbid any API changes in such applications.
>
> What we are proposing is that libpcap does not care about any backend. 
> It would just expose an API contract for *out-of-tree* backends to 
> implement.
>
> The mechanism for discovering and loading of these backends can be 
> discussed, but I personally think the only viable solution is dlopen(). 
> It allows OS/distros to ship a vanilla libpcap with dynamic loading 
> enabled and then let applications/backends contribute with their own 
> plugin. For example: there is no need to have D-Bus support if no D-Bus 
> application is installed.
>
> This proposal comes with a bonus: existing backends that are currently 
> built-in libpcap could use that same mechanism:
>
>         PCAP_SUPPORT_BT
>         PCAP_SUPPORT_BT_MONITOR
>         PCAP_SUPPORT_DBUS
>         PCAP_SUPPORT_LINUX_USBMON
>         PCAP_SUPPORT_NETFILTER
>         PCAP_SUPPORT_NETMAP
>         PCAP_SUPPORT_RDMASNIFF
>
> And switch to a dynamically loadable plugin instead of having #ifdef's 
> sprinkled around the code base.
>
> --
> Robin
>
> # Shut off engine before fueling.
>
>
> --- End Message ---
_______________________________________________
tcpdump-workers mailing list -- tcpdump-workers () lists tcpdump org
To unsubscribe send an email to tcpdump-workers-leave () lists tcpdump org
%(web_page_url)slistinfo%(cgiext)s/%(_internal_name)s