[Oisf-users] [EXT] Re: Packet loss and increased resource consumption after upgrade to 4.1.2 with Rust support

[Nelson, Cooper]

Oh, it’s only reassembling a single 1,500 byte packet.  It could even be done by the driver in kernel space, then copied to the appropriate RSS queue (potentially arriving out-of-order).

That is great that we have two successful test cases on the X710 cards.  Now I just need to figure out how fix it on my ixgbe system!

-Coop

From: Michał Purzyński <michalpurzynski1 at gmail.com>
Sent: Wednesday, July 3, 2019 4:01 PM
To: Nelson, Cooper <cnelson at ucsd.edu>
Cc: Peter Manev <petermanev at gmail.com>; Cloherty, Sean E <scloherty at mitre.org>; Eric Urban <eurban at umn.edu>; Open Information Security Foundation <oisf-users at lists.openinfosecfoundation.org>
Subject: Re: [Oisf-users] [EXT] Re: Packet loss and increased resource consumption after upgrade to 4.1.2 with Rust support

It would be surprising indeed if such a low-memory card could reassemble entire TCP stream (that's potentially huge). All this card has is a small buffer, on the order of like 1MB or so, to allow for frames packetization (lol) to send ethernet framese over PCI-E packets.

Another interesting observation - there have been no packets on the wrong thread anymore in my X710 setup that hashes only IP src and dst. Again, this is according to expectations, but it's nice to have a data point that validates those.



On Wed, Jul 3, 2019 at 10:28 AM Nelson, Cooper <cnelson at ucsd.edu<mailto:cnelson at ucsd.edu>> wrote:
Ok this is very good info, thanks.

My only experience with the X710 cards is reading the documentation, which is where I first heard about this issue.  My memory is that the cards (or more likely the driver) had an option to “properly” handle fragmented TCP packets and recompute the hash after reassembly, however I haven’t been able to find it again after reviewing the docs.  It’s possible I misread or misremembered it.

-Coop
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openinfosecfoundation.org/pipermail/oisf-users/attachments/20190703/c7188291/attachment-0001.html>