builtin-plugins/Zeek_PacketSourceUDP/__load__.zeek

PacketSource::UDP

An opinionated Zeek packet source for the cloud.

Namespace:

PacketSource::UDP

Summary

Redefinable Options

PacketSource::UDP::implementation: PacketSource::UDP::ReceiverImplementation &redef	Which receiver implementation to use for the UDP receiver.
PacketSource::UDP::io_uring_buffer_shift: count &redef	Shift value for the buffer size.
PacketSource::UDP::io_uring_buffers: count &redef	The number of buffers for the ring.
PacketSource::UDP::io_uring_cq_entries: count &redef	The number of entries in the completion queue.
PacketSource::UDP::io_uring_sq_entries: count &redef	The number of entries in the submission queue.
PacketSource::UDP::poll_interval: interval &redef	Relax time for GetNextTimeout() when no packet was seen.
PacketSource::UDP::recvmmsg_buffer_size: count &redef	The size of an individual packet buffer for the recvmmsg() implementation.
PacketSource::UDP::recvmmsg_buffers: count &redef	The number of mmsghdrs to pass to recvmmsg() at once.
PacketSource::UDP::recvmmsg_use_selectable_fd: bool &redef	Whether to use select on the listening UDP socket to wake up Zeek’s IO loop.
PacketSource::UDP::udp_recv_buffer_size: count &redef	The size of the socket’s UDP receive buffer to configure in bytes

Detailed Interface

Redefinable Options

PacketSource::UDP::implementation

Type:

PacketSource::UDP::ReceiverImplementation

Attributes:

&redef

Default:

PacketSource::UDP::RECVMMSG

Which receiver implementation to use for the UDP receiver. Can be one of PacketSource::UDP::RECVMMSG or PacketSource::UDP::IO_URING.

PacketSource::UDP::io_uring_buffer_shift

Type:

count

Attributes:

&redef

Default:

14

Shift value for the buffer size. Default is 14, meaning a buffer size of (1 << 14) = 16KB. This covers jumbo packets and also has plenty of room for the SO_TIMESTAMP information as well.

PacketSource::UDP::io_uring_buffers

Type:

count

Attributes:

&redef

Default:

1024

The number of buffers for the ring.

PacketSource::UDP::io_uring_cq_entries

Type:

count

Attributes:

&redef

Default:

256

The number of entries in the completion queue. Used with io_uring_queue_init_params()

PacketSource::UDP::io_uring_sq_entries

Type:

count

Attributes:

&redef

Default:

2

The number of entries in the submission queue. We only submit a single multishot RECVMSG op at a time, so keep this pretty small.

PacketSource::UDP::poll_interval

Type:

interval

Attributes:

&redef

Default:

100.0 usecs

Relax time for GetNextTimeout() when no packet was seen.

Applies to the IO_URING implementation. Applies to the RECVMMSG implementation only if recvmmsg_use_selectable_fd is F.

PacketSource::UDP::recvmmsg_buffer_size

Type:

count

Attributes:

&redef

Default:

9248

The size of an individual packet buffer for the recvmmsg() implementation.

This is used for the iov_len field of an individual struct iovec. Defaults to 9216 + 32 bytes to cover jumbo packets and a bit of wiggle room for any extra encapsulation.

PacketSource::UDP::recvmmsg_buffers

Type:

count

Attributes:

&redef

Default:

1024

The number of mmsghdrs to pass to recvmmsg() at once.

PacketSource::UDP::recvmmsg_use_selectable_fd

Type:

bool

Attributes:

&redef

Default:

T

Whether to use select on the listening UDP socket to wake up Zeek’s IO loop.

This applies to the recvmmsg() implementation only.

If F, the packet source acts in polling mode which can be more efficient at high packet rates. However, this comes with a higher idle CPU usage due to the busy polling. See the poll_interval setting above, too. Read up on Zeek’s io_poll_interval_live variable if you’re considering tuning anything here.

PacketSource::UDP::udp_recv_buffer_size

Type:

count

Attributes:

&redef

Default:

16777216

The size of the socket’s UDP receive buffer to configure in bytes

Set this value to 0 to use the kernel default.