ZW21 Day2 A Better Way to Capture Packets with DPDK & DPDK plugin development (40 mins 2 sessions)
Channel: Zeek
Date: 09/12/2021

A Better Way to Capture Packets with DPDK  - Vlad Grigorescu 
& Scott Campbell 

Ask grizzled Zeek users how to capture packets, and you’ll get endless suggestions, myths, and magic. Some swear by commodity cards with AF_PACKET or PF_RING, others use Myricom or more specialized NICs. For the past decade, Intel has been hard at work on DPDK — a mature framework for developing high performance network applications. We’re releasing a Zeek plugin which provides a DPDK packet source, with similar functionality as the current AF_PACKET plugin.
We’ll present a performance comparison of two systems running identical hardware and scripts analyzing the same traffic. We’ll give an overview of the tight integration between the DPDK plugin and Zeek scripts, allowing you to ditch ethtool and change settings directly from Zeek. Finally we will provide a roadmap for the planned set of future capabilities.

As part of this work, we’ve also developed some scripts for systematically testing flow load-balancing on TapAgg and NICs. We’ll be releasing these as well, enabling users to check their current setup for correctness.

Details for DPDK plugin development and performance measurement - Vlad Grigorescu  & Scott Campbell 

This talk will provide some background information about the development of our DPDK plugin as well as some details on performance measurement of it as compared to similar interface capture systems. The talk will focus on three major topics:

     * Information about the differences between the DPDK and AF_PACKET data paths, functions, and configuration/control. 
     * Performance measurements and methodologies.
     * Design philosophy and our roadmap for functionality.