From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf0-x22d.google.com (mail-pf0-x22d.google.com [IPv6:2607:f8b0:400e:c00::22d]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by lists.bufferbloat.net (Postfix) with ESMTPS id 02A153B29E for ; Thu, 16 Mar 2017 12:27:45 -0400 (EDT) Received: by mail-pf0-x22d.google.com with SMTP id x63so21249332pfx.2 for ; Thu, 16 Mar 2017 09:27:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:subject:from:to:cc:date:in-reply-to:references :mime-version:content-transfer-encoding; bh=9lDKlGdcVT1x3W5DHxAs+uphpx9Gf5tPJhrOwrsHHF4=; b=FYq9K3YC22w0nVL/3+lXhPrrNNyNs7rgphWn3knX26drzEfaLBxoso9THxzd3wg0Hi z2ohp7hI3MvIGuunEv7Z2RBDSU3TFFs7Ah4AJV7icWZlohGWAErwWEj3pULhYMO534zz ASDd/k65hLK/VqY4eQeMMmRPGcZntzqChuxKgzmY9Yhshi6onO8WnSSmExXLsOmjhQKh SajHNKKq3J19fu9goyTnMYmh4f8Rwtqt8xI4Z+leVtvj3KQx7ubdEf+T2mwMuPL3abCm c24YRAKwcthc4r3ctEA/dn2hKF5+Otp8Efwgd55Jc5eAG1TLS3DSFmWe1cARuD3fkZbx 09vg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:subject:from:to:cc:date:in-reply-to :references:mime-version:content-transfer-encoding; bh=9lDKlGdcVT1x3W5DHxAs+uphpx9Gf5tPJhrOwrsHHF4=; b=AbKmiiFfatYmKOZ54P/+3ct8Z2ODHO52q68vIFV6sv8x/lYFy5XP92TrZxljU2+GWK ECeBDjSkRzhQwLOYN3a5WiAajFLWPQBV84jCHK73pMRS2j8YsRNQps/7IkjT/wm9osAd Z2d410MrwroFDJyho3rofgQ6LXQor0lIrUx2jj2msdjEVBPLRVyNAEquJAMnrbdbT0qw /gdB5vnC4CpuobBUdQ6btn94aNzmS84YaKsgM8HWomIzoGZqHMWH1KXio2TWSPGIHrd9 q7B1GSRACS6YuZfDwynDw/EBcIRf6Wx0QC+xiQpDLZOstly5gkfTSFFAR293qLBz2v6e GiaA== X-Gm-Message-State: AFeK/H3+UnvCzYM2sV5TA6ZuM4nBPnZJdZJ3UIuqm88mqxisRcfZUHWELdvj9oVDGe50RQ== X-Received: by 10.84.239.8 with SMTP id w8mr13551753plk.73.1489681665243; Thu, 16 Mar 2017 09:27:45 -0700 (PDT) Received: from ?IPv6:2620:0:1000:1704:c0e7:1b06:2a00:333d? ([2620:0:1000:1704:c0e7:1b06:2a00:333d]) by smtp.googlemail.com with ESMTPSA id n185sm11607933pga.9.2017.03.16.09.27.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 16 Mar 2017 09:27:44 -0700 (PDT) Message-ID: <1489681664.28631.221.camel@edumazet-glaptop3.roam.corp.google.com> From: Eric Dumazet To: Michael Richardson Cc: Dave Taht , bloat Date: Thu, 16 Mar 2017 09:27:44 -0700 In-Reply-To: <27209.1489679549@obiwan.sandelman.ca> References: <27209.1489679549@obiwan.sandelman.ca> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: Re: [Bloat] high speed packet and protocol processing in userspace? X-BeenThere: bloat@lists.bufferbloat.net X-Mailman-Version: 2.1.20 Precedence: list List-Id: General list for discussing Bufferbloat List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 16 Mar 2017 16:27:46 -0000 On Thu, 2017-03-16 at 11:52 -0400, Michael Richardson wrote: > Dave Taht wrote: > > Is it faster to execute 17 bpf vm instructions on (nearly) every > > packet, or to use all that old stuff? > > > bpf example for the babel protocol: > > I have no data for you. Andrew McGregor might know more? > My understanding is that there is a JIT for ebpf. ebpf is pretty fast. > > > B) Are there any means of easily abstracting deeper protocol processing > > into a higher level grammar, better than tcpdump? I found one tool, > > that I like conceptually - for deeply decoding a protocol - > > tcpdump just exposes the libpcap compiler. It has many annoying limitations. > > > I've googled, and thunk, and maybe I'm merely asking the wrong > > questions, and "the packet analysis tool to end all tools" already > > exists? > > Yes, people have produced them, but they go nowhere because they are too > specialized, or too general. The question is: are you trying to build a tcp > stack that punts packets at applications, or do "analysis" --- which I interpret > to mean to collect statistics. Note that you can use C to write your parser, then use LLVM to generate native eBPF code. > > > C) Are vendors like mellonox or others doing network offloads parsing > > bpf or ebpf directly yet? > > I don't know. Netronome is (kind of) drivers/net/ethernet/netronome/nfp