Skip to content

v1.7.0

Latest
Latest

Choose a tag to compare

View all tags
@vlrpl vlrpl released this 10 Aug 09:15
· 7 commits to main since this release
v1.7.0
440bf8f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This version brings major new features, improvements and fixes. It contains 222 non-merge commits since v1.6.0. Many thanks to all the contributors!

Wireshark integration

Retis can now export its capture in a pcapng format enriched with the full Retis event data embedded as a custom JSON block, and comes with a Wireshark dissector plugin that dynamically registers fields from the JSON schema. This means all Retis event metadata, including tracking IDs, collector data, drop reasons, etc., are available directly in Wireshark for display filtering and column customization.

See the pcap documentation for details.

Ftrace probe option

Kprobes now support a per-probe ftrace option (e.g. retis collect -p kprobe:some_func/ftrace -p other_func) that opens a stack-based tracking window. Events from any probed function called within the instrumented function's execution are automatically linked together using skb-tracking, making it easy to trace the full call chain for a given packet path.

See the collectors documentation for more details.

Output file rotation

A new --out-rotate option in the collect sub-command allows rotating the output file based on a size limit (e.g. retis collect --out-rotate 100MB), producing a set of numbered split files. The print, sort, pcap sub-commands and the Python API can transparently read the full set of split files. Limiting the number of output files is also supported via --out-rotate-count.

SCTP support

SCTP packets are now parsed and displayed. SCTP support was also added to the ct collector, including the vtag fields in both original and reply directions.

IPsec and MACsec packet support

ESP (Encapsulating Security Payload), AH (Authentication Header) and MACsec packets are now parsed and printed, improving support for debugging IPsec and MACsec setups.

Geneve options

Geneve options are now printed, including the GRO hint option set when double tunneling is used, providing extra visibility for debugging GRO-related issues.

Other improvements

  • stats sub-command: a new retis stats sub-command prints a summary of a capture file: number of events, time range, probes present, and related metadata. It supersedes the former --list-probes option of the pcap sub-command.
  • Stack tracking: ovs and kretprobe context matching now uses a stack-based identifier instead of the thread ID, which is more reliable and avoids subtle false positives.
  • qdisc drop reasons: support for the qdisc drop reason subsystem was added, allowing drop reasons to be reported for qdisc code paths.
  • Debian kernel version parsing: Debian-specific kernel version strings are now correctly parsed.
  • Container image: the image is now also available for aarch64, with usage being transparent when using the container script or podman/docker directly.
  • Bumped libbpf-rs to 0.27 and btf-rs to 2.0, with the latter bringing new features and API improvements.
  • New next shell-based functional test infrastructure, with growing test coverage.
  • Various documentation fixes and improvements.
  • Various dependency updates and minor bug fixes.
Assets 2
Loading