EtherTAP - Collecting Packets
May 5, 2025
This post explains how to collect packets with EtherTAP and collect
.
This post explains how to collect packets with EtherTAP and collect
.
f448()
is another tabulation hashing function which maps two uint32_t
to an uniform hash result of type uint64_t
. This is useful to implement a skiplist based consistent hash ring with 2^64 possible ring slots (or positions).
This post explains the basic usage of EtherTAP: How to start, stop and control it when running in background.
IXDP is a layer above libxdp/AF_XDP which is responsible for XDP ring management operating with a set of interfaces in promiscuous mode. IXDP registers its specific set of RPCL functions (words) which allow to control and configure the IXDP packet processing layer. This posts explains the IXDP packet processing flow in general and outlines the related RPCL functions (words) for the different stages.
RPCL is a minimalistic configuration and control language, initially designed to act as a CLI for daemon-like background processes. RPCL is an acronym for Reverse Polish Configuration (and Control) Language.
f82()
is hash function which hashes a unt64_t
8 byte unsigned integer key to a uint16_t
2 byte hash value. It belongs to the class of tabulation hashing functions and is perfect for implementing lock-less hash tables and other data structures that require an uniform and perfect distribution.
Skip lists are a probabilistic data structure that seem likely to supplant balanced trees as the implementation method of choice for many applications. Skip list algorithms have the same asymptotic expected time bounds as balanced trees and are simpler, faster and use less space.
EtherTAP is a software based Ethernet analysis and monitoring security tool which allows to obtain insight and to record selected (or all) traffic for further analysis and evaluation. EtherTAP is based on IXDP, which is an internal API at Inlab Networks on top of libxdp/AF_XDP. XDP/AF_XDP in zero-copy mode allows packet processing at wire-speed up to 100GbE full duplex.
This post collects helpful links and resources concerning OUI/Mac Address Vendor lookups and registration.
When uniform random numbers are needed in C, just applying modulo is not enough. Whith using random() for portability and a few calculations this can be easily fixed.