Hi,
We are experiencing a strange issue with PF_RING/libpcap
with the packet payload changing right under the hood within the callback,
without any apparent reason.
The flow is basically running two threads on eth2@0 and
eth2@1 RSS queues
callBack()
pcap_read_packet()
pcap_read_linux()
pcap_dispatch()
..
main()
I am working on simplify and generate an example though it
is not an easy task.
# uname -a
Linux ct10k 2.6.32-220.4.2.el6.i686 #1 SMP Tue Feb 14
00:24:28 GMT 2012 i686 i686 i386 GNU/Linux
# cat /proc/net/pf_ring/7592-eth2.49*
Bound Device(s) :
eth2
Active : 1
Breed :
Non-DNA
Sampling Rate : 1
Capture Direction :
RX only
Socket Mode :
RX+TX
Appl. Name :
<unknown>
IP Defragment :
No
BPF Filtering :
Disabled
# Sw Filt. Rules : 0
# Hw Filt. Rules : 0
Poll Pkt Watermark : 1
Num Poll Calls : 0
Channel Id Mask :
0x00000001
Cluster Id : 0
Slot
Version : 15 [5.6.0]
Min Num
Slots : 5399
Bucket Len :
1519
Slot Len :
1552 [bucket+header]
Tot Memory :
8388608
Tot Packets :
639755
Tot Pkt Lost : 362816
Tot Insert :
276939
Tot Read :
268808
Insert Offset :
2594936
Remove Offset :
2597608
TX: Send Ok : 0
TX: Send Errors : 0
Reflect: Fwd Ok : 0
Reflect: Fwd Errors: 0
Num Free Slots : 0
Bound Device(s) : eth2
Active : 1
Breed :
Non-DNA
Sampling Rate : 1
Capture Direction :
RX only
Socket Mode :
RX+TX
Appl. Name :
<unknown>
IP Defragment :
No
BPF Filtering :
Disabled
# Sw Filt. Rules : 0
# Hw Filt. Rules : 0
Poll Pkt Watermark : 1
Num Poll Calls : 0
Channel Id Mask :
0x00000002
Cluster Id : 0
Slot
Version : 15 [5.6.0]
Min Num
Slots : 5399
Bucket Len :
1519
Slot Len :
1552 [bucket+header]
Tot Memory :
8388608
Tot Packets :
619081
Tot Pkt Lost :
124764
Tot Insert :
494317
Tot Read :
481677
Insert Offset :
7515736
Remove Offset :
5550312
TX: Send Ok : 0
TX: Send Errors : 0
Reflect: Fwd Ok : 0
Reflect: Fwd Errors: 0
Num Free Slots : 0
[root@ct10k forescout]# ethtool -i eth2
driver: ixgbe
version: 3.11.33
firmware-version: 0x800000cb
bus-info: 0000:06:00.0
supports-statistics: yes
supports-test: yes
supports-eeprom-access: yes
supports-register-dump: yes
A potential hint is that the issue correlates with being at the
end of the ring, e.g.,
(gdb) p bp-handle->ring->buffer
$2 = 8386304
Any advice would be welcome,
Best,
Oren
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
