summaryrefslogtreecommitdiff
path: root/netsniff-ng.8
diff options
context:
space:
mode:
authorDaniel Borkmann <daniel@iogearbox.net>2015-04-22 22:11:50 +0200
committerDaniel Borkmann <daniel@iogearbox.net>2015-04-22 22:13:50 +0200
commita6d81446c350218e36e53716ff277886069794b9 (patch)
tree8a56b75f2a821d440f68b601b9368be0b787192d /netsniff-ng.8
parent56d79391b748563cc5075b9d31fe199db8a2d093 (diff)
man: netsniff-ng: document fanout options
Properly document the new knobs for doing packet socket's fanout, i.e. that is, --fanout-group/--fanout-type/--fanout-opts. Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'netsniff-ng.8')
-rw-r--r--netsniff-ng.825
1 files changed, 25 insertions, 0 deletions
diff --git a/netsniff-ng.8 b/netsniff-ng.8
index 748a390..82c0f78 100644
--- a/netsniff-ng.8
+++ b/netsniff-ng.8
@@ -84,6 +84,31 @@ specify a pcap file as the output device, the file name must have
configuration will be written to stdout if the input device is a pcap file, or a
pcap file if the input device is a networking device.
.PP
+.SS -C <id>, --fanout-group <id>
+If multiple netsniff-ng instances are being started that all have the same packet
+fanout group id, then the ingress network traffic being captured is being
+distributed/load-balanced among these group participants. This gives a much better
+scaling than running multiple netsniff-ng processes without a fanout group parameter
+in parallel, but only with a BPF filter attached as a packet would otherwise need
+to be delivered to all such capturing processes, instead of only once to such a
+fanout member. Naturally, each fanout member can have its own BPF filters attached.
+.PP
+.SS -K <hash|lb|cpu|rnd|roll|qm>, --fanout-type <hash|lb|cpu|rnd|roll|qm>
+This parameter specifies the fanout discipline, in other words, how the captured
+network traffic is dispatched to the fanout group members. Options are to distribute
+traffic by the packet hash (\[lq]hash\[rq]), in a round-robin manner (\[lq]lb\[rq]),
+by CPU the packet arrived on (\[lq]cpu\[rq]), by random (\[lq]rnd\[rq]), by rolling
+over sockets (\[lq]roll\[rq]) which means if one socket's queue is full, we move on
+to the next one, or by NIC hardware queue mapping (\[lq]qm\[rq]).
+.PP
+.SS -L <defrag|roll>, --fanout-opts <defrag|roll>
+Defines some auxillary fanout options to be used in addition to a given fanout type.
+These options apply to any fanout type. In case of \[lq]defrag\[rq], the kernel is
+being told to defragment packets before delivering to user space, and \[lq]roll\[rq]
+provides the same roll-over option as the \[lq]roll\[rq] fanout type, so that on any
+different fanout type being used (e.g. \[lq]qm\[rq]) the socket may temporarily roll
+over to the next fanout group member in case the original one's queue is full.
+.PP
.SS -f, --filter <bpf-file|expr>
Specifies to not dump all traffic, but to filter the network packet haystack.
As a filter, either a bpfc(8) compiled file can be passed as a parameter or