Re: How can I create and use a Tap device

From: Robert Watson (rwatson_at_freebsd.org)
Date: 11/18/04

  • Next message: Julian Elischer: "Re: How can I create and use a Tap device"
    Date: Thu, 18 Nov 2004 16:48:28 +0000 (GMT)
    To: Elton Machado <elton.machado@norteglobal.com>
    
    

    On Thu, 18 Nov 2004, Elton Machado wrote:

    > I need a virtual ethernet device, can I use tap for that?
    >
    > How can I create it?

    Really quite easy, and fairly well documented in the man page. Basically,
    you need to:

    - Load the module or compile it in.
    - Open /dev/tapX where X is the interface number. When the device is
      opened, the network interface will be instantiated.
    - Read ethernet frames -- you'll get one per read, make sure to provide
      enough buffer room for a full frame at the MTU of choice.
    - Write ethernet frames -- one per write.

    Typically input from a tap device will look something like this:

            char packet[MAXPACKET];
            struct ether_header *h;
            ssize_t len, recvlen;

            len = MAXPACKET;
            recvlen = read(tap_fd, packet, len);
            if (recvlen == -1) {
                    perror("read");
                    return (-1);
            }
            if (len < sizeof(struct ether_header)) {
                    fprintf(stderr, "short frame read");
                    return (-1);
            }

            eh = (struct ether_header *)(packet);
            ...

    And a write will look something like this:

            sendlen = write(tap_fd, packet, recvlen);
            if (sendlen == -1) {
                    perror("write");
                    return (-1);
            }
            if (sendlen != recvlen) {
                    fprintd(stderr, "short frame write");
                    return (-1);
            }

    Make sure to properly initialize the ethernet frame header with the
    protocol type, source/destination ethernet addresses, and so on.

    A couple of performance caveats:

    - Every packet delivery requires going to user space, so possibly a
      context switch and certainly a system call.
    - Every packet is copied to user space, and/or from user space, so you get
      a lot of memory copying.

    For prototyping or light-weight stuff, tap is a great tool, but to improve
    performance you want to run network code in the kernel, especially if
    there are other applications running (and/or processing packets), which
    will increase the number of context switches. The cost as it stands isn't
    bad -- I regularly use tap-derived tunnel software for remote network
    access without a hitch. There were recently some posts made with patches
    to optimize the allocation of kernel memory for packets sent using a tap
    device, which are in the mailing list archives (not sure if they were
    merged yet).

    Robert N M Watson FreeBSD Core Team, TrustedBSD Projects
    robert@fledge.watson.org Principal Research Scientist, McAfee Research

    _______________________________________________
    freebsd-net@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-net
    To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"


  • Next message: Julian Elischer: "Re: How can I create and use a Tap device"

    Relevant Pages

    • Re: How can I create and use a Tap device
      ... >>I need a virtual ethernet device, can I use tap for that? ... >A couple of performance caveats: ... thid delivers teh packet to a netgraph interface which can be then used ...
      (freebsd-net)
    • Re: [PATCH 2/4 - 2.6.15]net: 32 bit (socket layer) ioctl emulation for 64 bit kernels
      ... from user space to a compat_timeval type. ... the support of the SuSE's and Redhat's, any patches accepted by the ... TEST1: create socket: passed ... Packet size out = 7 ...
      (Linux-Kernel)
    • RE: Ethernet tap vs. spanned port
      ... "Tap A" copies packets that go from A to B only, ... The Tap always mirrors the full packet, it is a layer-1 device only ... previously had the SNORT box on a spanned port on a Cisco 3500 switch. ... I then had both IDS running off of the same Ethernet tap with the ...
      (Focus-IDS)
    • Re: Load balanced routers and IDS
      ... >> Install 2 NetOptics Taps on the inside of both firewalls. ... >> Then plug in your snort box to the hub. ... That means that if you receive a packet on both ... tap, and smash them together on the hub, resulting in a collision. ...
      (Focus-IDS)
    • Re: PCI transaction rate question.
      ... Ethernet frames, the card can only receive about 70,000 packets/sec ... I've always blamed the rate at which the CPU can ... I've done the speed tests and Linux is downright awful at packet ...
      (comp.arch)