go-metro

README

go-metro

Requirements

This go package requires the great gopacket - it provides awesome packet decoding and pcap integration in Go. Unfortunately gopacket imposes a restriction on the go version due to some language features such as three-index slices - you will need go >=1.2. You will also need the PCAP library in your system - should be easy to find in any *NIX-style system in your package manager (apt-get, yum, ports, homebrew, etc). Also available in windows here - untested though!:

Description

This tool aims to passively calculate TCP RTTs between hosts communicating with us. What we do is fairly straightforward, we follow TCP streams active within a certain period of time and estimate the RTT between any outgoing packet with data, and its corresponding TCP acknowledgement. Because the PCAP library provides timestamping we are able to compute with a realtive high degree of precision the difference in time between these two events. To protect ourselves from duplicates and breaks in communication we use the TS and TSecr values in the TCP Options, if available, to differentiate between duplicates. For the time being we have chosen to ignore streams in which our host in not actively participating (ie. just ACKing incoming data) because in that scenario we do not know when the next incoming packet may come - it may not be imminent, there may be breaks in communication - and that would cause reporting inflated RTT values.

Usage

• Make sure you have cloned gopacket into your $GOPATH/src, and have PCAP lib in your system.
• Clone this repo into your $GOPATH/src

cd $GOPATH
go get -a -v github.com/DataDog/go-metro
go install github.com/DataDog/go-metro

• You should now have the executable in $GOPATH/bin.
• Have fun!

Linux tip

You don't need to run this as root, you can set CAP_NET_RAW capabilities on the executable - you will need sudo rights to do that though.

sudo setcap cap_net_raw+ep $GOPATH/bin/go-metro

And you're good to go, no need to be super anymore!

Note: Please note that you will need your filesystem to have extended security attributes enabled to allow setting capabilities on files. This will normally involve having your kernel built with a configuration enabling CONFIG_EXT3_FS_SECURITY, CONFIG_EXT4_FS_SECURITY, CONFIG_REISERFS_FS_SECUIRTY, etc and CONFIG_EXT3_FS_XATTR, CONFIG_EXT4_FS_XATTR, CONFIG_REISERFS_FS_XATTR, etc - depending on your filesystem. The good news is that Ubuntu/Fedora/Mint kernels are typically built with these features enabled straight out of the box. Also, you might have to ensure the partition is mounted to enable support xattr.

Agent 5.x >= 5.27.0

Plase note that if you are running the bundled go-metro with datadog agent 5.x w/ version >= 5.27.0, the file provided in /opt/datadog-agent/bin/go-metro is actually a wrapper script. The binary is actually found in /opt/datadog-agent/bin/go-metro.bin and so you should make sure you run the setcap commands provided above on that binary and not the wrapper script.