conntrack not working in mlx5

[Bing Zhao]

Hi Ali,

Which DPDK version are you using?
Could you try to use liberal mode firstly? Then the Seq/ACK/Win check will be ignored and only the state change will be tracked.

Thanks

From: Haider Ali <haider at dreambigsemi.com>
Sent: Thursday, February 16, 2023 10:05 PM
To: users <users at dpdk.org>; Bing Zhao <bingz at nvidia.com>
Cc: Ori Kam <orika at nvidia.com>; Slava Ovsiienko <viacheslavo at nvidia.com>; Asaf Penso <asafp at nvidia.com>
Subject: conntrack not working in mlx5

External email: Use caution opening links or attachments

Hi All,

We were trying to test conntrack feature with testpmd, but we are not receiving any packets. Could you let us know the step which we are missing?

Here are our test steps
Step 1: Configuring conntract in testpmd:
sudo ./build/app/dpdk-testpmd -l 4,6 -a 04:00.0 --file-prefix=ha -- -i --rxq=16 --txq=16 --disable-rss

set conntrack com peer 1 is_orig 1 enable 1 live 1 sack 1 cack 0 last_dir 0 liberal 0 state 1 max_ack_win 7 r_lim 5 last_win 510 last_seq 2632987379 last_ack 2532480967 last_end 2632987379 last_index 0x8
set conntrack orig scale 7 fin 0 acked 1 unack_data 0 sent_end 2632987379 reply_end 2633016339 max_win 28960 max_ack 2632987379
set conntrack rply scale 7 fin 0 acked 1 unack_data 0 sent_end 2532480967 reply_end 2532546247 max_win 65280 max_ack 2532480967

flow indirect_action 0 create ingress action conntrack / end

flow create 0 ingress pattern eth / ipv4 / tcp / end actions jump group 3 / end
flow create 0 group 3  ingress pattern eth / ipv4 / tcp / end actions indirect 0 / jump group 5 / end

flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is 1 / end actions queue index 5 / end
flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is 2 / end actions queue index 5 / end
flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is 4 / end actions queue index 5 / end
flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is 8 / end actions queue index 5 / end
flow create 0 group 5 ingress pattern eth / ipv4 / tcp / conntrack is 16 / end actions queue index 5 / end

start
set verbose 1

Step 2: Sending scapy packet:
We have tried multiple types of packets, but we were not able to see any packet in the testpmd
sendp(Ether(dst="00:aa:bb:cc:dd:ff")/IP(ttl=0x25)/TCP(dport=123,window=510,flags=0x12,seq=2632987379,ack=2532480968 ),iface="enp4s0f0",count=1)


sendp(Ether()/IP(src="192.168.0.2", dst="10.0.0.2")/TCP(sport=1024, dport=2048, flags=0x02, seq=100), iface="enp4s0f0")
sendp(Ether()/IP(src="192.168.0.2", dst="10.0.0.2")/TCP(sport=1024, dport=2048, flags=0x10, seq=101, ack=201), iface="enp4s0f0")
sendp(Ether()/IP(src="192.168.0.2", dst="10.0.0.2")/TCP(sport=1024, dport=2048, flags=0x10, seq=101, ack=201)/"X", iface="enp4s0f0")
sendp(Ether()/IP(src="192.168.0.2", dst="10.0.0.2")/TCP(sport=1024, dport=2048, flags=0x11, seq=102, ack=201), iface="enp4s0f0")
sendp(Ether()/IP(src="192.168.0.2", dst="10.0.0.2")/TCP(sport=1024, dport=2048, flags=0x10, seq=103, ack=202), iface="enp4s0f0")

>>> sendp(Ether()sendp(Ether()/IP(src="192.168.0.2", dst="10.0.0.2")/TCP(sport=1024, dport=2048, flags=0x11, seq=102, ack=201), iface="enp4s0f0")

Step 3: Checking counters stats:
BEFORE sending the packet
$ ethtool -S enp4s0f0
NIC statistics:
     rx_vport_unicast_packets: 51
     rx_vport_unicast_bytes: 3986
     rx_packets_phy: 55
   rx_bytes_phy: 4242
     rx_64_bytes_phy: 36
     rx_prio0_bytes: 4242
     rx_prio0_packets: 55

AFTER sending the packet
$ ethtool -S enp4s0f0
NIC statistics:
     rx_vport_unicast_packets: 52
     rx_vport_unicast_bytes: 4050
     rx_packets_phy: 56
     rx_bytes_phy: 4306
     rx_64_bytes_phy: 37
     rx_prio0_bytes: 4306
     rx_prio0_packets: 56

Note: We also tried iperf3 traffic but no packets were seen in testpmd.

Regards,
Haider
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mails.dpdk.org/archives/users/attachments/20230222/c16d6f7b/attachment-0001.htm>