ring: netsniff-ng: migrate capture only to TPACKET_V3

Lets migrate capturing to TPACKET_V3, since it will bring a better
performance due to fewer page cache misses caused by a higher density
of packets, since now they are contigous placed in the ring buffer.

It is said that TPACKET_V3 brings the following benefits:

 *) ~15 - 20% reduction in CPU-usage
 *) ~20% increase in packet capture rate
 *) ~2x increase in packet density
 *) Port aggregation analysis
 *) Non static frame size to capture entire packet payload

Signed-off-by: Daniel Borkmann <dborkman@redhat.com>

1 files changed, 20 insertions, 9 deletions

diff --git a/dissector.h b/dissector.h
index d211e06..2c2c128 100644
--- a/dissector.h
+++ b/dissector.h
@@ -9,6 +9,7 @@
 
 #include <stdlib.h>
 #include <stdint.h>
+#include <linux/if_packet.h>
 
 #include "ring.h"
 #include "tprintf.h"
@@ -45,31 +46,41 @@ static inline const char *__show_ts_source(uint32_t status)
 		return "";
 }
 
-static inline void show_frame_hdr(struct frame_map *hdr, int mode)
+static inline void __show_frame_hdr(struct sockaddr_ll *s_ll,
+				    void *raw, int mode, bool v3)
 {
 	char tmp[IFNAMSIZ];
+	union tpacket_uhdr hdr;
 
 	if (mode == PRINT_NONE)
 		return;
 
+	hdr.raw = raw;
+
 	switch (mode) {
 	case PRINT_LESS:
 		tprintf("%s %s %u",
-			packet_types[hdr->s_ll.sll_pkttype] ? : "?",
-			if_indextoname(hdr->s_ll.sll_ifindex, tmp) ? : "?",
-			hdr->tp_h.tp_len);
+			packet_types[s_ll->sll_pkttype] ? : "?",
+			if_indextoname(s_ll->sll_ifindex, tmp) ? : "?",
+			v3 ? hdr.h3->tp_len : hdr.h2->tp_len);
 		break;
 	default:
 		tprintf("%s %s %u %us.%uns %s\n",
-			packet_types[hdr->s_ll.sll_pkttype] ? : "?",
-			if_indextoname(hdr->s_ll.sll_ifindex, tmp) ? : "?",
-			hdr->tp_h.tp_len, hdr->tp_h.tp_sec,
-			hdr->tp_h.tp_nsec,
-			__show_ts_source(hdr->tp_h.tp_status));
+			packet_types[s_ll->sll_pkttype] ? : "?",
+			if_indextoname(s_ll->sll_ifindex, tmp) ? : "?",
+			v3 ? hdr.h3->tp_len : hdr.h2->tp_len,
+			v3 ? hdr.h3->tp_sec : hdr.h2->tp_sec,
+			v3 ? hdr.h3->tp_nsec : hdr.h2->tp_nsec,
+			v3 ? "" : __show_ts_source(hdr.h2->tp_status));
 		break;
 	}
 }
 
+static inline void show_frame_hdr(struct frame_map *hdr, int mode)
+{
+	__show_frame_hdr(&hdr->s_ll, &hdr->tp_h, mode, false);
+}
+
 extern void dissector_init_all(int fnttype);
 extern void dissector_entry_point(uint8_t *packet, size_t len, int linktype, int mode);
 extern void dissector_cleanup_all(void);