Live Traffic Tracing

[hangyan]

Describe what you are trying to solve
Antrea Traceflow support tracing crafted traffic and first packet of live traffic. To help the end user get more insight into the live traffic, its would be better if we can support the following:

1. trace multiple packets based on proper sampling methods
2. trace packets on both sides

After trace multiple packets in real traffic, we can captured these packets and allow users to download and review them locally. Meanwhile, we can choose to generated various metadata based on these raw packets and show them in Octant UI.

Describe the solution you have in mind

Frist, the main archtecture of traceflow will stay unchanged. Besides that, we can:

1. use TC eBPF program to filter and mark packets based on sample configs
2. Match the sampled packets in ovs pipline ( same as what we are doing now)
3. Parse packet-in messages to get raw packet data and tracepath

Describe how your solution impacts user flows

A new field will be add to the traceflow CRD, we can call it sample, users can config their sample parameters in it.

Describe the main design/architecture of your solution

See doc: google doc link

Alternative solutions that you considered

Test plan

Additional context

[antoninbas]

There is no permission to comment for the Google doc?

In the doc, you write:

The extracted IPID, which will be used to correlated packets from different host

But it seems to me that you mean "differentiate packets from different hosts" and not "correlate packets from different hosts".

[antoninbas]

In the doc, you write:

The extracted IPID, which will be used to correlated packets from different host

But it seems to me that you mean "differentiate packets from different hosts" and not "correlate packets from different hosts".

Unless you mean match the packet captured at the source Node and the packet captured at the destination Node, to identify that this is the same packet.

[jianjuns]

We discussed in the community meeting, but also share my two general comments here:

1. I feel Traceflow CRD is overloaded. Probably we should have another CRD for packet capture and sample, which does not trigger "Traceflow" (tracing the first packet).
2. I wonder whether we need to capture packets on multiple Nodes and correlate them, which seems add much more complexity.

[hangyan]

There is no permission to comment for the Google doc?

In the doc, you write:

The extracted IPID, which will be used to correlated packets from different host

But it seems to me that you mean "differentiate packets from different hosts" and not "correlate packets from different hosts".

Sorry, I have updated the permis

There is no permission to comment for the Google doc?

In the doc, you write:

The extracted IPID, which will be used to correlated packets from different host

But it seems to me that you mean "differentiate packets from different hosts" and not "correlate packets from different hosts".

Sorry, I have updated the link and changed permissions. Please try again.

[hangyan]

In the doc, you write:

The extracted IPID, which will be used to correlated packets from different host

But it seems to me that you mean "differentiate packets from different hosts" and not "correlate packets from different hosts".

Unless you mean match the packet captured at the source Node and the packet captured at the destination Node, to identify that this is the same packet.

Yeah, I mean the same packet in differenet locations, use the IPID field to correlate them. I will update the doc to make that clear. Thanks

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment, or this will be closed in 90 days