使用PACKET_MMAP的PACKET_RX_RING时丢包过大

Question

在使用PACKET_MMAP (PACKET_RX_RING)捕获以太网数据包时，在100KB/s或更高的数据速率下，我有超过50%的数据包丢失。这种技术很常见吗？

在结合使用PACKET_MMAP和PACKET_RX_RING时，在代码/参数/逻辑方面是否有改进的机会或空间，以减少数据包丢失

#include <stdio.h>
#include <stdio.h>
#include <sys/socket.h>
#include <net/if.h>
#include <linux/if_ether.h>
#include <linux/if_packet.h>
#include <unistd.h>
#include <stdlib.h>
#include <stdint.h>
#include <sys/types.h>
#include <arpa/inet.h>
#include <sys/mman.h>
#include <poll.h>
#include <signal.h>



void handle_frame(struct tpacket_hdr* tphdr, struct sockaddr_ll* addr, char* l2content, char * l3content){

  if(tphdr->tp_status & TP_STATUS_USER){
    fwrite(l2content,tphdr->tp_snaplen,1,pcapfile);
    tphdr->tp_status = TP_STATUS_KERNEL;
  }
}

int main(){
  file1 = fopen("file1.cap","a+");



int fd = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
if (fd == -1) {
  perror("socket");
  exit(1);
 }

struct tpacket_req req = {0};
req.tp_frame_size = TPACKET_ALIGN(TPACKET_HDRLEN + ETH_HLEN) + TPACKET_ALIGN(1500);
req.tp_block_size = sysconf(_SC_PAGESIZE);
while (req.tp_block_size < req.tp_frame_size) {
  req.tp_block_size <<= 1;
 }
 req.tp_block_nr = 4;
size_t frames_per_buffer = req.tp_block_size / req.tp_frame_size;
req.tp_frame_nr = req.tp_block_nr * frames_per_buffer;

 int version = TPACKET_V1;
  (setsockopt(fd, SOL_PACKET, PACKET_VERSION, &version, sizeof(version));

 setsockopt(fd, SOL_PACKET, PACKET_RX_RING, (void*)&req, sizeof(req));

size_t rx_ring_size = req.tp_block_nr * req.tp_block_size;
char* rx_ring = mmap(0, rx_ring_size, PROT_READ|PROT_WRITE, MAP_SHARED, fd, 0);

struct pollfd fds[1] = {0};
fds[0].fd = fd;
fds[0].events = POLLIN;
size_t frame_idx = 0;
char* frame_ptr = rx_ring;

while (1) {
  struct tpacket_hdr* tphdr = (struct tpacket_hdr*)frame_ptr;
  while (!(tphdr->tp_status & TP_STATUS_USER)) {
    if (poll(fds, 1, -1) == -1) {
      perror("poll");
      exit(1);
    }
  }

  struct sockaddr_ll* addr = (struct sockaddr_ll*)(frame_ptr + TPACKET_HDRLEN - sizeof(struct sockaddr_ll));
  char* l2content = frame_ptr + tphdr->tp_mac;
  char* l3content = frame_ptr + tphdr->tp_net;
  handle_frame(tphdr, addr, l2content, l3content);

  frame_idx = (frame_idx + 1) % req.tp_frame_nr;
  int buffer_idx = frame_idx / frames_per_buffer;
  char* buffer_ptr = rx_ring + buffer_idx * req.tp_block_size;
  int frame_idx_diff = frame_idx % frames_per_buffer;
  frame_ptr = buffer_ptr + frame_idx_diff * req.tp_frame_size;
 }

fflush(pcapfile);
fclose(pcapfile);
}

Answer 1

msgboardpana，

检查你的RX环设置：tp_block_size = page size (它等于几个以太网帧与标准MTU = 1512字节，对于我与2Kb页面它一个帧) tp_block_nr = 4 - frame num 4-注意它物理上不连续的空间！我想你的缓冲环刚刚溢出了。我真的建议你增加tp_block_size (我使用next，我的页面是2Kb:)

tp.tp_block_size = BLOCK_SIZE; //(PAGE_2K * PAGE_2K)
tp.tp_block_nr = BLOCK_NR;     //BLOCK_NR            (1)
tp.tp_frame_size = PAGE_2K; /* Max size eth frame is 1522 bytes */
tp.tp_frame_nr = (tp.tp_block_size * tp.tp_block_nr) / tp.tp_frame_size;

并减少块的数量。

另外，尝试减少你的循环周期中的syscall-我建议你在单独的线程中写入文件，因为它非常繁重的syscall(只是为了防止你可能会检查时间)，另外，我建议你在eth上启用promisc模式-添加到初始化代码中：

struct packet_mreq mreq = {0};
mreq.mr_ifindex = if_idx.ifr_ifindex;
mreq.mr_type = PACKET_MR_PROMISC;
if (setsockopt(sockfd, SOL_PACKET, PACKET_ADD_MEMBERSHIP, &mreq, sizeof(mreq)) == -1) 
{
    perror("setsockopt");
    goto closefd;
}

如果您决定将文件写入和捕获线程分开，则捕获线程的sched_fifo策略如下：

ret = pthread_attr_setschedpolicy(&tattr, SCHED_FIFO);

致以问候，布拉特