-
Notifications
You must be signed in to change notification settings - Fork 31
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
TCP flag-based sampling ("Smart sampling") #91
Comments
wdyt about making it configurable, e.g.
That would allow to mitigate Cons 2 giving users more control on it. |
@jotak Just to make sure that I understand your configuration format, considering the following values
It should be interpreted as:
|
@jotak totally agree with the above --- assuming:: (1) @shach33 @praveingk and @msherif1234 will agree that this doesn't add a lot ( or any)of overhead to the eBPF code :-) |
@ronensc yes; with the subtlety that it's not exactly "every Nth flow", as the sampling is probabilistic, not deterministic (as you can see here: netobserv-ebpf-agent/bpf/flows.c Lines 201 to 203 in c54e7eb
|
@eranra My understanding is that it adds a little overhead, as we need read TCP headers for every packet, including ones that could otherwise be ignored due to sampling. |
@jotak maybe the user space ebpf agent will translate the friendly conf to some more straightforward and efficient rules to be used in the kernel. Yes, we need to "look" on every packet but this is what eBPF TC hook is for anyway. |
When sampling is enabled, we might miss important events such as establishment and termination of TCP connections.
It may be useful to add a setting that makes the agent always sending flows that contain specific TCP flags (e.g. SYN, FIN).
This will make sure that no connection will be missed.
Cons:
cc: @eranra @jotak @praveingk @shach33
The text was updated successfully, but these errors were encountered: