You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
If retis was able to extract UFIDs from the kernel, we would need to talk to OVS to enrich them.
There are currently two interesting ways to enrich UFIDs:
ovs-appctl dpctl/get-flow [dp] ufid:ufid prints the datapath flow, given a UFID ovs-appctl ofproto/detrace prints the Openflow flows that generated the datapath flow, given a UFID.
This all looks awesome right? What's the catch? Well, the catch is that UFIDs are very volatile. Any change in the OpenFlow flows can make them disappear or if traffic stops matching it, they are expired.
So, the only good way of doing this enrichment is to do it live! That is the challenge: send live requests to OVS without overloading it or delaying event processing too much.
An initial idea (tentative) is:
Main thread will send UFIDs to an secondary thread.
The secondary thread will throttle (configurable requests/sec) and cache requests and create metadata events with the enriched information
sort command will find metadata events associated with (past or future) events
The text was updated successfully, but these errors were encountered:
Context: #439
If retis was able to extract UFIDs from the kernel, we would need to talk to OVS to enrich them.
There are currently two interesting ways to enrich UFIDs:
ovs-appctl dpctl/get-flow [dp] ufid:ufid
prints the datapath flow, given a UFIDovs-appctl ofproto/detrace
prints the Openflow flows that generated the datapath flow, given a UFID.This all looks awesome right? What's the catch? Well, the catch is that UFIDs are very volatile. Any change in the OpenFlow flows can make them disappear or if traffic stops matching it, they are expired.
So, the only good way of doing this enrichment is to do it live! That is the challenge: send live requests to OVS without overloading it or delaying event processing too much.
An initial idea (tentative) is:
sort
command will find metadata events associated with (past or future) eventsThe text was updated successfully, but these errors were encountered: