Project

General

Profile

Bug #1778

af_packet: IPS and defrag

Added by Eric Leblond over 2 years ago. Updated about 1 month ago.

Status:
Assigned
Priority:
High
Assignee:
Target version:
Affected Versions:
Effort:
Difficulty:

Description

defrag is not compatible with IPS mode as reconstructed packets will be too big when sent over the wire. So we need to warn the user about that. But when defrag is disabled, the cluster_flow load balancing will not work correctly so we need to propose an alternative configuration to improve things.

History

#1 Updated by Victor Julien over 2 years ago

I think currently safe scenarios are:

workers mode with 1 thread per interface, af-packet defrag disabled
autofp mode with 1 thread per interface, af-packet defrag disabled

If the network is guaranteed to be free of fragmentation (e.g. firewall policy blocks it), multiple threads per interface can be used.

#2 Updated by Victor Julien over 2 years ago

  • Status changed from New to Assigned
  • Priority changed from Normal to High
  • Target version set to Soon

#3 Updated by Victor Julien over 2 years ago

Of the current cluster modes, could there be something that helps? E.g. cluster_cpu with some additional configs outside of suri?

#4 Updated by Victor Julien over 1 year ago

  • Subject changed from af_packet IPS and defrag to af_packet: IPS and defrag
  • Description updated (diff)

#5 Updated by Eric Leblond about 1 month ago

Cluster ebpf with ippair implementation should fix that. XDP CPU redirect will do too.

Also available in: Atom PDF