netdev - Re: Avoiding bridge flood of multicast when L2 switch is used

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20160614202626.GD8518@lunn.ch>
Date:	Tue, 14 Jun 2016 22:26:26 +0200
From:	Andrew Lunn <andrew@...n.ch>
To:	Murali Karicheri <m-karicheri2@...com>
Cc:	"open list:TI NETCP ETHERNET DRIVER" <netdev@...r.kernel.org>,
	john.r.fastabend@...el.com, Florian Fainelli <f.fainelli@...il.com>
Subject: Re: Avoiding bridge flood of multicast when L2 switch is used

> netdev experts,
> 
> When there is a L2 switch underneath the network interface a flooding of
> multicast at the bridge interface results in one copy of this going through each
> of the slave resulting in multiple multicast packets reaching the underlying switch.

Yes, this is something Florian, Vivien and i have discussed. We don't
yet see a way around it. Neither the Marvell or Broadcast switches
have a mechanism to say: Send this frame out of this list of
interfaces. All we can do is send it out a single interface. Even if
we could direct a single frame out multiple interfaces, we still have
the problem of how to teach the bridge about this, in a clean and
elegant fashion.

Overall, this seems like a hard problem. Since it is a hard problem,
implementing IGMP snooping first would make sense. Don't forward the
packet out a port unless you know there is somebody interested in it.
The swichdev parts of IGMP snooping are in place, we just need to
continue them down into DSA.

> L2 switch also duplicates the multicast packet on each egress port as done
> in software bridge. This is undesirable as it reduces the available bandwidth to
> half when multicast packets are involved.

Once you have a DSA driver, the switch will not do this replication.
So you will gain something there.

     Andrew