veyepar: How to capture 100G Ethernet traffic at wire speed to local disk

Author(s):	Christoph Lameter
Location	Room 8
Date	jan Thu 16	Days Raw Files
Start	13:30	First Raw Start	error-in-template
Duration	0:45:0	Offset	None
End	14:15	Last Raw End
Chapters
Total cuts_time	None min.

https://lca2020.linux.org.au/schedule/presentation/18/
raw-playlist raw-mp4-playlist encoded-files-playlist mp4 svg png

assets release.pdf How_to_capture_100G_Ethernet_traffic_at_wire_speed_to_local_disk.json
logs
Admin: episode episode list cut list raw files day marks day marks day image_files

State:

Locked:

clear this to unlock

Locked by:

user/process that locked.

Start:

initially scheduled time from master, adjusted to match reality

Duration:

length in hh:mm:ss

Name:

Video Title (shows in video search results)

Emails:

email(s) of the presenter(s)

Released:

has someone authorised pubication

Normalise:

Channelcopy:

m=mono, 01=copy left to right, 10=right to left, 00=ignore.

Thumbnail:

filename.png

Description:

markdown

Capturing Ethernet data sounds simple. Who has not run tcpdump? But things are not that simple at 100G anymore due to restrictions on performance of the disk subsystems and the Linux operating system overhead. And why would one want to capture 100G traffic? One reason is that most of the fiber optic wide area links are being converted from 10Gbps to 100Gbps circuits and another is that it is mandatory to capture all traffic going through links in some industries due to government regulation (well governments may want to capture traffic too for other reasons). And one does not want to build a large distributed file system or a large RAID array for that. What we want is a simple 1U Pizza box that can be deployed anywhere without too much fuss where 100G lines are deployed.

This talk is going on a journey through the various hardware and software considerations to get a box like that configured and talks about numerous hard lessons learned as to what works and what did not. On the way we encounter numerous hardware and software limitations that seem to be blocking the way and that required creative solutions.

Comment:

production notes