Пример файла /opt/VPNagent/etc/ipsm_dpdk.cfg:
[PERFORMANCE]
threads = 237 ;maximum: (cpu core num (maximum:254, including HyperThreading) - 2 - 3 * ports_num) -- processing (encrypt/decrypt/filter) threads number
;sendqueue_size = 64000 ;min: 1000 max: 200000 default: 64000 -- size of re-order fixing queue
;disable_sendqueue = no ;yes/no, default: no -- disable re-order fixing queue
;tx_retries = 10 ;min: 0 max: 1000 default: 10 -- retries count for outgoing packets before drop
;tx_delay = 20 ;min: 0 max: 200 default: 20 -- delay in microseconds before another retry of sending packet burst
;rx_desc = 4096 ;min: 32 max: 4096 default: 4096 -- number of rx descriptors in network adapter configuration
;tx_desc = 4096 ;min: 32 max: 4096 default: 4096 -- number of tx descriptors in network adapter configuration
;no_max_freq = no ;yes/no, default: no -- disable setting max possible frequency for our processor cores
;sendq_burst_threshold = 0 ;min: 100 max: 100000 default: 0 (disabled) -- make a delay, if sending N packets from sendqueue in a row
;sendq_burst_delay = 10 ;min: 1 max: 200 default: 10 -- delay in microseconds when sendq_burst_threshold activated
;pcap_mpool_size = 262143 ;min: 6736: max 4194303: default: auto -- number of buffers in single memory pool, 1 pool per port
;rx_queue_len = 16 ;min: 1 max: 32 default: 16 -- size of thread queue (in bursts)
;rx_sleep = 50 ;min: 0 max: 10000 default: 50 -- pause in microseconds on rx thread if there are no packets incoming
;tx_sleep = 50 ;min: 0 max: 10000 default: 50 -- pause in microseconds on tx thread if there are no packets to send
;wrk_sleep = 50 ;min: 0 max: 10000 default: 50 -- pause in microseconds on wrk thread if there are no packets incoming
;kni_sleep = 50 ;min: 0 max: 10000 default: 50 -- pause in microseconds on kni thread if there are no packets incoming or outgoing
;cb_wait = 50 ;min: 0 max: 10000 default: 50 -- wait in microseconds on wrk thread if corresponding tx thread is busy
;rx_cache_size = 64000 ;min: 2000: max 200000: default: 64000 -- size of rx thread packet cache
;wrk_overload_thresh = 90 ;min: 1: max 100: default: 90 -- threshold (in %) of wrk thread queue fill when it counts as "overloaded"
[EAL]
corelist = 0-6,8-125,135-254
;coremask = 0x1 ;mask of cpu cores to run on, including HyperThreading
;corelist = 0-1 ;list of cpu cores to run on, including HyperThreading
;channels = 1 ;min: 1 max: 8 default: 1 -- memory channels number
;cpuset = (0-2,4)@(0-1) ;map threads to cpu cores: <threads[@cpus]>[<,threads[@cpus]>...]
eal_log_level = 7 ;min: 1 max: 8 default: 4 -- log level of dpdk messages
;rx_pthresh = 8 ;min: 0 max: 255 default: 8 -- rx prefetch threshold register value
;rx_hthresh = 8 ;min: 0 max: 255 default: 8 -- rx host threshold register value
;rx_wthresh = 4 ;min: 0 max: 255 default: 4 -- rx write-back threshold register value
;tx_pthresh = 36 ;min: 0 max: 255 default: 36 -- tx prefetch threshold register value
;tx_hthresh = 0 ;min: 0 max: 255 default: 0 -- tx host threshold register value
;tx_wthresh = 0 ;min: 0 max: 255 default: 0 -- tx write-back threshold register value
[MISC]
print_stats = yes ;yes/no, default: yes -- print send/receive/drop statistics
stats_file = /tmp/pkt_stats.txt ;name of file for print_stats
;stats_file_size = 10 ;min: 1 max: 100 default: 10 -- max size of statistics file in megabytes. After rotate, previous instance saves as ".old"
;stats_period = 1 ;min: 1: max: 86400 default: 1 -- at this period (in seconds) statistics is collected
;print_frames = no ;yes/no, default: no -- print incoming/outgoing packets in hex
;frames_file = /tmp/frames.txt ;name of file for print_frames
;frames_file_size = 50 ;min: 1 max: 200 default: 50 -- max size of packet hexdump file in megabytes. After roteate, previous instance saves as ".old"
;frames_time = no ;yes/no, default: no -- print time for each packet in print_frames
rte_log_file = /tmp/rte_log.txt ;name of file for dpdk log messages
;rte_log_file_size = 10 ;min: 1 max: 100 default: 10 -- max size of rte_log file in megabytes. After rotate, previous instance saves as ".old"
;pf_max_bytes = 42 ;min: 14 max: 1400 default: 42 -- print only N firs bytes in print_frames
;natt_port = 4500 ;min: 1 max: 65535: default: 4500
;enable_pdump = no ;yes/no, default: no -- enable packet dump with dpdk-pdump utility
;macaddr_update_period = 200;min:1 max: 10000 default: 200 -- gateway mac address update period in milliseconds
;kmod_name = igb_uio ;igb_uio/vfio-pci/uio_pci_generic, default: igb_uio -- name of kernel module for port binding
[PORT0]
pci_id = 0000:01:00.0
l3_ip = 172.16.0.1/24
gw_ip = 172.16.0.2
pair_port = 1
mtu = 9700
outer = yes ;yes/no, default: no -- consider port as looking to outer network; outer port can't be in l2-mode
;next_hop_mac = 00:00:00:00:00:00 ;default destination mac-address for outgoing IPv4 frames
;next_hop_mac6 = 00:00:00:00:00:00 ;default destination mac-address for outgoing IPv6 frames
;next_hop_mac_force = no ;yes/no, default no -- always set next_hop_mac as destination mac address for outgoing IPv4 frames
;next_hop_mac6_force = no ;yes/no, default no -- always set next_hop_mac6 as destination mac address for outgoing IPv6 frames
;dp_frag_ip = 0.0.0.0 ;default: disabled -- ip addresses (4 max, "," as divider) of gate dp partners for this port
;dp_frag_ip6 = ;disabled -- ipv6 addresses (4 max, "," as divider) of gate dp ipv6 partners for this port
;dp_frag_natt = no ;yes/no, default no -- enable fragmentation fix for natt
;frag_id_afterward = no ;yes/no, default no -- set frag id before send
;vlan_identifier = 0 ;min: 0 max: 4094 default: 0 -- 802.1Q VLAN identifier (VID)
;vlan_priority_code_point = 0 ;min: 0 max: 7 default: 0 -- Priority code point (PCP) which refers to the 802.1p class of service
;allowed_ethertypes = none ;ethertypes in hex (32 max, "," as divider) -- pass this ethertypes to/from corresponding vEth. IPv4(0x0800) and ARP(0x0806) always passed, others dropped by default
;no_fc = no ;yes/no, default no -- disable flow control on this port
;no_promisc = yes ;yes/no, default: yes (for l2-port port - no) -- disable promiscuous mode on this port
;multicast_enable = yes ;yes/no, default: yes (for l2-port - no) -- enable receiving all multicast ip packets mode on this port
;hw_ip_checksum = yes ;yes/no, default: yes -- enable additional stats about l3/l4 checksum errors and oversized packets
;hw_vlan_extend = no ;yes/no, default: no -- enable double-vlan. Disables Vector-RX on i40e
;pmtud = 8000 ;min: 68 max: 65535 default: disabled -- send "ICMP Destination Unreachable -- Fragmentation Needed" for ip packets with DF bit, greater than N bytes
;mssfix = 8000 ;min: 536 max: 9670 default: disabled -- change MSS field in forwarded tcp syn packets if it greater than N
;mssfix_force = no ;yes/no, default: no -- always change MSS field in forwarded tcp syn packets, even if it's lesser than mssfix value
[PORT1]
pci_id = 0000:21:00.0
l2_src_ip = 172.16.0.1
l2_dst_ip = 172.16.0.2
pair_port = 0
mtu = 9600
;thr_start = 0 ;min: 0 max: <threads - 1> -- first processing thread for this port
;thr_count = <threads> ;min: 1 max: <threads - thr_start> -- number of processing threads for this port
;no_fc = no ;yes/no, default no -- disable flow control on this port
;no_promisc = no ;yes/no, default: no (for outer port - yes) -- disable promiscuous mode on this port
;multicast_enable = no ;yes/no, default: no (for outer port - yes) -- enable receiving all multicast ip packets mode on this port
;copy_tos = no ;yes/no, default: no -- copy ToS-field from orig ip header to l2-encapsulation ip header
;df_handling = clear ;copy/set/clear, default clear -- DF bit: copy from orig ip header to l2-encapsulation ip header
;hw_ip_checksum = yes ;yes/no, default: yes -- enable additional stats about l3/l4 checksum errors and oversized packets
;hw_vlan_extend = no ;yes/no, default: no -- enable double-vlan. Disables Vector-RX on i40e
;pmtud = 8000 ;min: 68 max: 65535 default: disabled -- send "ICMP Destination Unreachable -- Fragmentation Needed" for ip packets with DF bit, greater than N bytes
;mssfix = 8000 ;min: 536 max: 9670 default: disabled -- change MSS field in forwarded tcp syn packets if it greater than N
;mssfix_force = no ;yes/no, default: no -- always change MSS field in forwarded tcp syn packets, even if it's lesser than mssfix value