3 ms·
Iptables sits in the kernel and is also not available on non-Linux platforms like FreeBSD. With packet bricks you bypass the kernel and expose "virtual" interfa
by mavam 11y ago
Iptables sits in the kernel and is also not available on non-Linux platforms like FreeBSD. With packet bricks you bypass the kernel and expose "virtual" interfaces to your applications by means of a simple configuration. Here's an example from the README:
bricks> lb = Brick.new("LoadBalancer", 2)
bricks> lb:connect_input("eth3")
bricks> lb:connect_output("eth3{0", "eth3{1", "eth3{2", "eth3{3", "eth2")
bricks> pe:link(lb)
This binds pkteng pe with LoadBalancer brick and asks the system to read ingress packets from eth3 and split them flow-wise based on the 2-tuple (src & dst IP addresses) metadata of the packet header. The "lb:connect_output(...)" command creates four netmap-specific pipes named "netmap:eth3{x" where 0 <= x < 4 and an egress interface named "eth2". The traffic is evenly split between all five channels based on the 2 tuple header as previously mentioned. Userland applications can now use packet-bricks to get their fair share of ingress traffic. The brick is finally linked with the packet engine.
- eikenberry 11y agoSo the goals of packet bricks are portability and ease of configuration, not performance gains?
- mavam 11y agoThe goal is to have both. In fact, the whole point of kernel bypass is performance, so just having ease of configuration would defeat the point. We're using packet bricks primarily for high-performance network monitoring in environments with more than 10 Gbps aggregate upstream traffic.