<div dir="ltr"><br><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Apr 25, 2018 at 11:25 PM, Laine Stump <span dir="ltr"><<a href="mailto:laine@laine.org" target="_blank">laine@laine.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">When an nwfilter rule sets the parameter CTRL_IP_LEARNING to "dhcp",<br> this turns on the "dhcpsnoop" thread, which uses libpcap to monitor<br> traffic on the domain's tap device and extract the IP address from the<br> DHCP response.<br> <br> If libpcap on the host is built with TPACKET_V3 defined, the dhcpsnoop<br> code's initialization of the libpcap socket fails with the following<br> error:<br> <br> virNWFilterSnoopDHCPOpen:1134 : internal error: pcap_setfilter: can't remove kernel filter: Bad file descriptor<br> <br> It turns out that this was because libpcap with TPACKET_V3 defined<br> requires a larger buffer size than libvirt was setting (we were<br> setting it to 128k). Changing the buffer size to 256k eliminates the<br> error, and the dhcpsnoop thread once again works properly.<br> <br> Thanks to Christian Ehrhardt <<a href="mailto:paelzer@gmail.com">paelzer@gmail.com</a>> for discovering that<br> buffer size was the problem.<br> <br> Resolves: <a href="https://bugzilla.redhat.com/show_bug.cgi?id=1547237" rel="noreferrer" target="_blank">https://bugzilla.redhat.com/<wbr>show_bug.cgi?id=1547237</a><br> Signed-off-by: Laine Stump <<a href="mailto:laine@laine.org">laine@laine.org</a>><br> ---<br> src/nwfilter/nwfilter_<wbr>dhcpsnoop.c | 2 +-<br> 1 file changed, 1 insertion(+), 1 deletion(-)<br> <br> diff --git a/src/nwfilter/nwfilter_<wbr>dhcpsnoop.c b/src/nwfilter/nwfilter_<wbr>dhcpsnoop.c<br> index 6069e70460..62eb617515 100644<br> --- a/src/nwfilter/nwfilter_<wbr>dhcpsnoop.c<br> +++ b/src/nwfilter/nwfilter_<wbr>dhcpsnoop.c<br> @@ -259,7 +259,7 @@ struct _virNWFilterDHCPDecodeJob {<br> * libpcap 1.5 requires a 128kb buffer<br> * 128 kb is bigger than (DHCP_PKT_BURST * PCAP_PBUFSIZE / 2)<br> */<br></blockquote><div><br></div><div>I just started building with the change for a few tests on this - no results yet.</div><div><br></div><div>But we are all puzzled/unsure enough on the size that I'd already ask to modify the comment above to explain the new size.</div><div><br></div><div>Maybe we should explain:</div><div>- why 128 isn't enough</div><div>- why you chose "only" 256</div><div>- why the default size might be too big</div><div>- your size considerations for many guest scenarios</div><div><br></div><div>That will help the next one stumbling over this code.</div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> -# define PCAP_BUFFERSIZE (128 * 1024)<br> +# define PCAP_BUFFERSIZE (256 * 1024)<br> <br> # define MAX_QUEUED_JOBS (DHCP_PKT_BURST + 2 * DHCP_PKT_RATE)<br> <span class="HOEnZb"><font color="#888888"> <br> -- <br> 2.14.3<br> <br> --<br> libvir-list mailing list<br> <a href="mailto:libvir-list@redhat.com">libvir-list@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/libvir-list" rel="noreferrer" target="_blank">https://www.redhat.com/<wbr>mailman/listinfo/libvir-list</a><br> </font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><span style="color:rgb(136,136,136);font-size:12.8px">Christian Ehrhardt</span><div style="color:rgb(136,136,136);font-size:12.8px">Software Engineer, Ubuntu Server</div><div style="color:rgb(136,136,136);font-size:12.8px">Canonical Ltd</div></div></div></div></div> </div></div>