Inquiry about Capturing Network Traffic on DPDK Interface

[shashank-6777]

Dear Team,

I hope this message finds you well. I'm currently exploring the possibility of capturing network traffic on a DPDK interface within our OpenShift environment. I believe this could provide valuable insights into our network performance and troubleshooting efforts as most of the Telco application (user plane) used DPDK interfaces.

Is it possible to capture network traffic on a DPDK interface in our OpenShift setup using this operator ?

Thank you for your time and expertise. Looking forward to your input.

[jotak]

Hello @shashank-6777 ,
I must admit I am not familiar at all with DPDK but I asked some engineers around , if I understand correctly with dpdk the kernel network stack is bypassed, which would not allow netobserv to capture flows since it is hooking at the tc level. So this wouldn't work.
Can I ask you, is it a specific CNI that you use and that uses dpdk? I'm not sure if CNIs such as openshift-sdn or ovn can be configured to use dpdk, I don't think so (?)

[shashank-6777]

Hi @jotak,

Thanks for your response,

Your understanding is correct, DPDK bypasses the kernel network stack, tools that rely on kernel-level hooks, like netobserv which hooks into the tc (traffic control) layer, may indeed face challenges in capturing and monitoring network flows when DPDK is in use.

We have installed our cluster by using OVN as CNI and we are injecting secondary interfaces (VF"s) using multus as vfio-pci device type (Intel xxv710 nic card).

I understand from your explanation that capturing network traffic in a DPDK-based environment can be challenging due to the bypassing of the kernel network stack, but the thing is customer wants to monitor the traffic for all interfaces in the application pod i.e OVN/IPVLAN/MacVlan (able to capture) but the DPDK interface plays a crucial role in achieving high-performance data processing in 5G networks. Monitoring this interface allows you to identify performance bottlenecks, latency issues, and resource utilization patterns.

Thank you for your time and expertise. Looking forward to your input.

[jotak]

any idea if the dpdk plugin is able to export flows in NetFlows or IPFIX format? Netobserv is able to collect IPFIX flows, although it has been deprecated because our eBPF agent provides better performances, essentially thanks to avoiding too many kernel-userspace copies ... but the context with DPDK is different and it seems like Netflows would make more sense here. It might be a good reason to bring back our netflows collection full support, if it can help

[shashank-6777]

Hi @jotak,

Thanks for your response,

Sorry but as per my knowledge DPDK itself does not natively provide plugins or libraries specifically designed to export flows in NetFlow or IPFIX format. DPDK is primarily focused on providing libraries and tools for high-performance packet processing in user space, and flow export is often not within its core scope.

i think since DPDK interfaces operate in user space, you might need to tap the traffic flowing through those interfaces. One approach could be using technologies like eBPF (already in use by your operator) to tap into the network stack and capture relevant packets, Cilium, which is often used with DPDK and Kubernetes, provides eBPF-based networking and security features that could be useful here. sorry but am not a expert may be am wrong.

It might be a good reason to bring back our netflows collection full support, if it can help
It really helps to all the cloud platform vendors because as per my search there is no opensource tool by which we can monitor DPDK interfaces in kubernetes/openshift. Also help people like us to push customer to use this tool for there edge infra structure.

Please let me know you expert advice and suggestion.

Thanks in advance

[jotak]

hey @shashank-6777 , fyi, we plan starting a PoC soon: https://issues.redhat.com/browse/NETOBSERV-1272

[shashank-6777]

@jotak, That's great to hear!
Your assistance is greatly appreciated.

[shashank-6777]

Hi @jotak is there any update on this ?

[shashank-6777]

hi @jotak , How are your doing.

Is this RFP is open or drop ?
If possible could you please update if you and your team are working.

[jotak]

Hey @shashank-6777 , sorry for taking that long to answer. There are technical challenges we are facing and we don't have clear plans of how to address that. That doesn't mean this is dropped, I hope we'll be able to address that at some point, but I'm afraid that's not something coming anytime soon.