would it be hard to add nfs traffic detection?

[TheBigBear]

What would it take to add nfs traffic detection?

[GyulyVGC]

Hi @TheBigBear

As explained in this section, protocols are recognised based on the well-known transport port numbers defined by IANA.

In the next release, v1.2.2, I'm planning to introduce support for a new traffic filter based on the port number.
In this way, you could be able to monitor only the traffic from a port of your choice.

Would it be suitable to your needs?

[TheBigBear]

@GyulyVGC yes, that would work well as NFS can be on different ports depending on rpc daemon mapping and nfs version in use. Greta idea, thanks for your great work on this.

[GyulyVGC]

Thanks 🙏

Since the feature still has to be implemented, feel free to share your thoughts about one thing.
So far I have considered 3 possibilities:

• choose a single port number
• choose a range of ports (from x to y)
• choose a set of ports not necessarily contiguous (x, y, z...)

The third option would be the most complete from a technical point, but it'd be the least comfortable for the user to insert each port number manually.
For what concerns the second option, I don't see any particular case for which the user should monitor a given range of ports (but maybe there is some circumstance I'm not aware of)
The first case seems the most common to me and also the easiest for the user to setup (and for me to implement 🤣)

[TheBigBear]

@GyulyVGC as a techie myself, I think you are asking the wrong person here (🤣), I'd personally prefer if I could list a single or a port range, or multiple ports.
for nfs I would typically want the port for traffic to mountd, another for traffic to lockd, to statd, quoted and nfs v3 on 4045 or nfs v4 on 2049.

BTW in my sites implementation of nfs shares being mounted from linux to Windows I had to fix the usually dynamic ports for mountd,lockd and statd and used ephemeral ports sequentially 50250 - 50253

But in unnderstand and appluad the desire to keep the UI clean and simple and uncluttered.
Unfortunately I have a couple further questions ... sorry ... do you plan to allow the user to add a single choice or as many as he/she needs?

if it is a single choice, then I'd hope you would do option 3 , but if it allows for multiple choices I could easily live with option 1 and I just repeat it for as often as I need until they are all added.

Another related question, would users be able to specify whether to watch udp or tcp or both on the chosen port number?

Thanks for asking for my opinion ... but it is just that ... one opinion.

Thanks for the great work, I especially appreciate that it is across all my platforms.

[GyulyVGC]

Well, I guess I have to implement something more accurate than I originally thought 🤣
I just have to find a good trade-off between completeness and clearness.
I don't think I'll make available a selection of TCP vs UDP for each single port for the moment.
The idea is to keep UDP/TCP/both and then a separate port filter (so all the ports selected will be TCP/UPD/both).
I think at this point the most flexible solution is the third if I only want to pick one.

[GyulyVGC]

Traffic detection for more than 6000 services, including nfs, has been implemented in #450