From a6d81446c350218e36e53716ff277886069794b9 Mon Sep 17 00:00:00 2001 From: Daniel Borkmann Date: Wed, 22 Apr 2015 22:11:50 +0200 Subject: man: netsniff-ng: document fanout options Properly document the new knobs for doing packet socket's fanout, i.e. that is, --fanout-group/--fanout-type/--fanout-opts. Signed-off-by: Daniel Borkmann --- netsniff-ng.8 | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/netsniff-ng.8 b/netsniff-ng.8 index 748a390..82c0f78 100644 --- a/netsniff-ng.8 +++ b/netsniff-ng.8 @@ -84,6 +84,31 @@ specify a pcap file as the output device, the file name must have configuration will be written to stdout if the input device is a pcap file, or a pcap file if the input device is a networking device. .PP +.SS -C , --fanout-group +If multiple netsniff-ng instances are being started that all have the same packet +fanout group id, then the ingress network traffic being captured is being +distributed/load-balanced among these group participants. This gives a much better +scaling than running multiple netsniff-ng processes without a fanout group parameter +in parallel, but only with a BPF filter attached as a packet would otherwise need +to be delivered to all such capturing processes, instead of only once to such a +fanout member. Naturally, each fanout member can have its own BPF filters attached. +.PP +.SS -K , --fanout-type +This parameter specifies the fanout discipline, in other words, how the captured +network traffic is dispatched to the fanout group members. Options are to distribute +traffic by the packet hash (\[lq]hash\[rq]), in a round-robin manner (\[lq]lb\[rq]), +by CPU the packet arrived on (\[lq]cpu\[rq]), by random (\[lq]rnd\[rq]), by rolling +over sockets (\[lq]roll\[rq]) which means if one socket's queue is full, we move on +to the next one, or by NIC hardware queue mapping (\[lq]qm\[rq]). +.PP +.SS -L , --fanout-opts +Defines some auxillary fanout options to be used in addition to a given fanout type. +These options apply to any fanout type. In case of \[lq]defrag\[rq], the kernel is +being told to defragment packets before delivering to user space, and \[lq]roll\[rq] +provides the same roll-over option as the \[lq]roll\[rq] fanout type, so that on any +different fanout type being used (e.g. \[lq]qm\[rq]) the socket may temporarily roll +over to the next fanout group member in case the original one's queue is full. +.PP .SS -f, --filter Specifies to not dump all traffic, but to filter the network packet haystack. As a filter, either a bpfc(8) compiled file can be passed as a parameter or -- cgit v1.2.3-54-g00ecf