On Mon, Dec 14, 2015 at 2:17 PM, Aaron Conole <aconole at redhat.com> wrote:
> No need to donate to the cause on this one, I think :) The issues > surrounding tcpdump are, imo, ones of library/application workflow. HOW > does the user enable tcpdump-like support? The current option is to > start up with a pcap PMD configured, capture to a file for a bit, then > stop. I think the issues being discussed are what other options to give > the user. Then again, I may have my signals crossed somewhere. > I don't think you're crossing signals on giving options to users. However, I think we're discussing more than just high level UI options; we're getting into the details internal to any application involved in capturing packets. While it's great to give options to the user, we still need to get the captured packets to them. This poses a few challenges, since we need to do it with low impact(e.g. don't just write the packet to the HDD in the main packet processing loop), while not hammering the system with a crazy flood that takes down the kernel (copy everything to into some critical task). Both of these have been discussed in earlier threads/earlier in this thread. To me, these challenges boil down to: 1) Balancing a nice generic output interface with the most efficient way to get packets out of the application . 2) Filtering as close to the capture point as possible. Putting that together with giving options, we need to: 1) Give the users a convenient API to start a capture and provide a filter. 2) Balance a nice generic output interface with the most efficient way to get packets out of the application. 3) Filter as close to the capture point as possible. I've seen lots of ideas and options tossed around which would solve some or all of the above items, but nobody actually committing to anything. What can we do to actually agree on a solution to go and implement? I'm relatively new to the community, so I don't really know how this stuff works. Do people typically form a working group where they go off and discuss the problem, and then come back to the main community with a proposal? Or do people just submit RFCs independently with their own ideas? Thanks, Kyle
