How to capture 100G Ethernet traffic at wire speed to local disk
Room 6 | Thu 16 Jan | 1:30 p.m.–2:15 p.m.
Presented by
-
Christoph Lameter
@qant
http://gentwo.org
Christoph Lameter was working as a lead in research and development for an algorithmic trading company in Chicago until the end of 2018 and currently maintains the slab allocators and the percpu subsystem in the Linux Kernel. He contributed to a number of Linux projects since the initial kernel releases in the early 90s. As a kernel developer at SGI he helped pioneer the use of Linux for Supercomputing and developed the necessary kernel capabilities for HPC applications. He is working on improving Linux through the use of new faster APIs to a variety of high performance devices and is evaluating new technologies that allow faster processing.
Christoph Lameter
@qant
http://gentwo.org
Abstract
Capturing Ethernet data sounds simple. Who has not run tcpdump? But things are not that simple at 100G anymore due to restrictions on performance of the disk subsystems and the Linux operating system overhead. And why would one want to capture 100G traffic? One reason is that most of the fiber optic wide area links are being converted from 10Gbps to 100Gbps circuits and another is that it is mandatory to capture all traffic going through links in some industries due to government regulation (well governments may want to capture traffic too for other reasons). And one does not want to build a large distributed file system or a large RAID array for that. What we want is a simple 1U Pizza box that can be deployed anywhere without too much fuss where 100G lines are deployed.
This talk is going on a journey through the various hardware and software considerations to get a box like that configured and talks about numerous hard lessons learned as to what works and what did not. On the way we encounter numerous hardware and software limitations that seem to be blocking the way and that required creative solutions.
Linux Australia: http://mirror.linux.org.au/pub/linux.conf.au/2020/room_6/Thursday/How_to_capture_100G_Ethernet_traffic_at_wire_speed_to_local_disk_2.webm
YouTube: https://www.youtube.com/watch?v=uBBaVtHkiOI
Capturing Ethernet data sounds simple. Who has not run tcpdump? But things are not that simple at 100G anymore due to restrictions on performance of the disk subsystems and the Linux operating system overhead. And why would one want to capture 100G traffic? One reason is that most of the fiber optic wide area links are being converted from 10Gbps to 100Gbps circuits and another is that it is mandatory to capture all traffic going through links in some industries due to government regulation (well governments may want to capture traffic too for other reasons). And one does not want to build a large distributed file system or a large RAID array for that. What we want is a simple 1U Pizza box that can be deployed anywhere without too much fuss where 100G lines are deployed. This talk is going on a journey through the various hardware and software considerations to get a box like that configured and talks about numerous hard lessons learned as to what works and what did not. On the way we encounter numerous hardware and software limitations that seem to be blocking the way and that required creative solutions. Linux Australia: http://mirror.linux.org.au/pub/linux.conf.au/2020/room_6/Thursday/How_to_capture_100G_Ethernet_traffic_at_wire_speed_to_local_disk_2.webm YouTube: https://www.youtube.com/watch?v=uBBaVtHkiOI