Hi Peter increasing the number of ring slots improves in case of spikes, however I think this is not your case. The problem seems to be that the application can’t keep up with the ingress rate. If your application uses libpcap, you can consider using the libzero dna cluster + our pfring-aware libpcap.
Best Regards Alfredo On 25 Nov 2013, at 17:32, Peter Bates <[email protected]> wrote: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA1 > > > Hello all > > I'm running PF_RING 5.6.1 (i.e. stable) and > a number of applications. > > One of the applications requires me to run > transparent_mode=1 as I have no source - and so > I also can't use DNA. > > Running with Argus linked against PF_RING, I'm struck > by a 45%+ packet loss (based on /proc/net/pf_ring stats). > > cat /proc/net/pf_ring/info > PF_RING Version : 5.6.1 ($Revision: exported$) > Total rings : 35 > > Standard (non DNA) Options > Ring slots : 65536 > Slot version : 15 > Capture TX : No [RX only] > IP Defragment : No > Socket Mode : Standard > Transparent mode : Yes [mode 1] > Total plugins : 0 > Cluster Fragment Queue : 13672 > Cluster Fragment Discard : 72016672 > > A lot of the problem applications seem to have 'Num Free Slots : 0' > Is this because they're not using PF_RING efficiently, or > should I be increasing the number of ring slots further - the box has 64Gb of > RAM. > > Any advice appreciated! > > - -- > Peter Bates > Senior Information Security Officer Phone: +44(0)2076792049 > Information Services Division Internal Ext: 32049 > University College London > London WC1E 6BT > -----BEGIN PGP SIGNATURE----- > Version: GnuPG v1.4.13 (MingW32) > Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/ > > iQEcBAEBAgAGBQJSk3uUAAoJELhVoVpEMS6R/18H/2uUcC+1vIUV8WT35WErYTo9 > BTLJOlG5bjLwG+WqAhXNXLWJkoFpz36hZCARMVLWbpGI/bxoDPqTIbNnGx7rLKXB > dDHrN1vgbNme/7xZHxGQSdMXrMYZyM3BH37s0sNAwJ2EJeqY6jeMnv/YixZ3U6vg > Gye21hMn3LESiSVxGKtfDDBwUKfX4f7bcKuPxeWLnD37Et0NQoCoyAO4FJTmFonL > qTkm9z6JlLbZ9OZ8w3o/s4H05o1ygPjqUJaHBeZ5aO2lpjsQ2jcjf0JskTKtqTkF > ApR+8TUF4pbfuemlPaPziEI+b/qk7+6j1fwXK8YJNRyI7xoFZkATfncvXQk03ts= > =Dri/ > -----END PGP SIGNATURE----- > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
