[Oisf-users] [EXT] Re: Packet loss and increased resource consumption after upgrade to 4.1.2 with Rust support

[Nelson, Cooper]

That’s what I thought, but experiments that Peter and I have done have shown that even with one RSS queue and using the SEPTun 1 process (separating RSS from worker threads and using cluster_flow) that the packets are still sent to the wrong thread.

So either the cluster_flow hash is being calculated before reassembly, or the kernel/NIC hash is influencing cluster_flow in some way.

Everything I’ve read, including source code, is along the lines of what you are saying.  However, in practice it doesn’t work.

-Coop

From: Michał Purzyński <michalpurzynski1 at gmail.com>
Sent: Wednesday, July 3, 2019 1:01 AM
To: Nelson, Cooper <cnelson at ucsd.edu>
Cc: Peter Manev <petermanev at gmail.com>; Cloherty, Sean E <scloherty at mitre.org>; Eric Urban <eurban at umn.edu>; Open Information Security Foundation <oisf-users at lists.openinfosecfoundation.org>
Subject: Re: [Oisf-users] [EXT] Re: Packet loss and increased resource consumption after upgrade to 4.1.2 with Rust support

1. af_packet flow defragments before calculating hash
2. cluster_flow ignores hardware hash and computes it on its own
3. cluster_qm uses skb_get_queue_mapping() and gets an index of a queue from the hardware (so it uses the hardware hashing, although implictly)

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190703/086106eb/attachment.html>