(16) capture: in-dataplane pcapng packet capture

[daniel-noland]

DPDK owns the NICs, so tcpdump on the host sees nothing of the dataplane's traffic. This adds packet capture from inside the pipeline, started from the CLI and written as pcapng.

capture start [ingress=*|VPC] [egress=*|VPC] [packets=N] [seconds=N] [sample=N]
capture stop
show capture

Given	Captures	Matched on
neither	both directions, everything	—
ingress=V	packets entering from V	outer VXLAN VNI (nothing else identifies the VPC before decap)
egress=W	packets leaving towards W	dst_vpcd
both	the V → W conversation, at egress only	src_vpcd and dst_vpcd

Defaults: 10000 packets, 60 s, every matching packet. * matches any VPC, including none. Files go to /var/run/dataplane/capture/capture-<UTC start>.pcapng. That location is a stopgap until the pod has a persisted one.

Design

• Headers, not buffers. A capture stage copies a packet's parsed headers and selected metadata into a record. Buffers never leave their core (Mbuf stays !Send). A single writer thread rebuilds the frames, so a capture has no payload: pcapng shows each packet with captured length < original length.
• Inner frames. For a VXLAN packet the record keeps the inner headers. The outer ones repeat almost unchanged from packet to packet. The outer VNI goes into the comment.
• Metadata as text. Each packet carries a key=value comment that stock Wireshark can filter on (frame.comment contains "done=AclDropped"):
  direction= frame= vxlan_vni= thread= done= iif= oif= src_vni= src_vpc= dst_vni= dst_vpc= flow=
• Names, not numbers. Interfaces are named as the router names them, not by kernel ifindex, which means nothing once a device is unbound. A VNI is reported as a VNI, and a VPC name is added only where the config defines one.
• Workers never block. With no capture running, a stage costs one relaxed load per burst. A running capture filters, then samples (one counter per stage, nothing shared), then takes a unit of a shared packet budget, and only then copies. Records go out with try_send on a bounded queue. A full queue drops the record and counts it.
• Nothing lost silently. Ending a capture swaps the remaining budget to zero, which closes admission atomically. The writer then drains until written + dropped = admitted. capture stop returns once the file is complete. The report is also written into the file.

Commits

1. capture: record, pcapng writer (pcap-file pinned to =3.0.0-rc.3), pipeline stage
2. concurrency: the loom backend gets a bounded sync_channel built on loom's Mutex/Condvar. loom's own channel has no bounded flavour and doesn't model hang-up. Without this the workspace's loom build doesn't compile.
3. capture: controller and writer thread
4. dataplane: capture stages first in the pipeline and right after Egress
5. cli, routing: the commands
6. capture: inner frames of VXLAN packets
7. capture: VPC filter

Testing

• A property test (bolero) writes generated packets, some wrapped in VXLAN, and reads them back with pcap-file. It checks every frame byte-for-byte against the packet's (inner) wire bytes, plus interface, timestamp, direction and comment.
• Shuttle tests race stop against workers with a one-slot queue: written + dropped = admitted ≤ budget, and the file holds exactly the written packets. I checked that the schedules aren't vacuous: they cover stops before, during and after admission, with drops. The controller tests are deliberately not run under loom (CI time).
• An end-to-end routing test drives a real router over its CLI socket. It starts a capture, checks that a second start and an unknown VPC are refused, records a burst, stops, and reads the file back to check the interface name.
• Not yet run against real traffic. It needs the test bench.

Unrelated: test_cli_handling (routing) failed 4× in a row on its FRR-config check at exactly 3.018 s under load average ~11. It then passed repeatedly on identical code, so it looks like a timeout flake.

🤖 Generated with Claude Code

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

❌ Patch coverage is 91.25561% with 117 lines in your changes missing coverage. Please review.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
capture/src/controller.rs	87.55%	21 Missing and 9 partials ⚠️
cli/bin/cmdtree_dp.rs	0.00%	30 Missing ⚠️
routing/src/cli/capture.rs	82.22%	21 Missing and 3 partials ⚠️
dataplane/src/packet_processor/mod.rs	0.00%	12 Missing ⚠️
capture/src/directory.rs	82.35%	8 Missing and 1 partial ⚠️
capture/src/tests/mod.rs	97.39%	5 Missing ⚠️
capture/src/stage.rs	93.47%	3 Missing ⚠️
capture/src/record.rs	97.97%	2 Missing ⚠️
cli/src/cliproto.rs	90.00%	1 Missing ⚠️
routing/src/cli/handler.rs	98.80%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!