I want to capture Raw Packets from any host and capture them in a file like "recieved.pcap" bypassing the kernel. I am using a virtual ec2 instace for this. To bypass kernel I have set up DPDK on my instance. I am new to networking and any help would be appreciated !
I have:
I ran testpmd application ,and here is the output :
[ec2-user@ip-172-31-82-187 app]$ sudo ./testpmd -l 0-3 -n 4 -- -i
EAL: Detected 8 lcore(s)
EAL: Detected 1 NUMA nodes
EAL: Multi-process socket /var/run/dpdk/rte/mp_socket
EAL: Selected IOVA mode 'PA'
EAL: No available hugepages reported in hugepages-1048576kB
EAL: Probing VFIO support...
EAL: PCI device 0000:00:05.0 on NUMA socket -1
EAL: Invalid NUMA socket, default to 0
EAL: probe driver: 1d0f:ec20 net_ena
EAL: PCI device 0000:00:06.0 on NUMA socket -1
EAL: Invalid NUMA socket, default to 0
EAL: probe driver: 1d0f:ec20 net_ena
Interactive-mode selected
testpmd: create a new mbuf pool <mbuf_pool_socket_0>: n=171456, size=2176, socket=0
testpmd: preferred mempool ops selected: ring_mp_mc
Warning! port-topology=paired and odd forward ports number, the last port will pair with itself.
Configuring Port 0 (socket 0)
Port 0: 16:61:BE:67:49:75
Checking link statuses...
Done
Error during enabling promiscuous mode for port 0: Operation not supported - ignore
Based on the intercept scenario, there are 4 options to solve this problem
Please follow the steps to capture the traffic appropriately. For
Option-1:
sudo ./build/app/dpdk-pdump -- --pdump 'port=0,queue=*,tx-dev=./tx.pcap'
. This will capture packets that enter from outside and write into tx.pcap.Option-2:
sudo ./build/app/dpdk-pdump -- --pdump 'port=0,queue=*,tx-dev=./tx.pcap'
. This will capture packets that enter from outside and write into tx.pcapOption-3:
sudo ./build/basicfwd -l 2 --vdev=net_tap0,mac="mac address of DPDK port" -a <PCIe BDF>
.sudo ifconfig dtap0 <ip address/mask> up
Option-4:
ping -I <interface name> stackoverflow.com
./build/l2fwd -l 2 --vdev=net_pcap0,iface=<interface name> -- -p 1 -T 1 --no-mac-updating
)sudo ./build/app/dpdk-pdump -- --pdump 'port=0,queue=*,tx-dev=./tx.pcap'
Note:
option 3
, as it eliminates the need for DPDK secondary process and disabling ASLR.