Hello, Recently I updated my sensors to use PF_RING 5.6.2, after a good long while on an SVN version of 5.6.1. Initial results on a lightly loaded test box were good, however when the same setup was loaded onto more heavily loaded boxes we started seeing a substantial number of dropped packets.
We use the ixgbe PF_RING aware drivers on RHEL 6. The /proc/net/pf_ring/info reports: PF_RING Version : 5.6.2 ($Revision: exported$) Total rings : 28 Standard (non DNA) Options Ring slots : 16384 Slot version : 15 Capture TX : No [RX only] IP Defragment : No Socket Mode : Standard Transparent mode : No [mode 2] Total plugins : 0 Cluster Fragment Queue : 32720 Cluster Fragment Discard : 69173446 The Cluster Fragment Discard numbers are much larger than usual. Additionally the NIC started reporting drops (less than 1%, but compared to the previous setup which dropped 0 packets at the NIC). Finally, the snort and argus processes running on top of this setup now report drops at a much higher rate than before. Previously snort ran with 1% or less drops, argus typically dropped only a few thousandths of a percent. Currently, snort is reporting drops of 15-20%, and argus is seeing roughly 15% drops as well. This is on a 10 Gb link with peaks of 1.8 Gb/sec with daytime averages of 1.4 Gb/sec. Similar, although smaller, increases in dropped packets was seen on another link that is much less loaded (300-500 Mb/sec, loss typically in the 5-10% range). Overall this is a substantial loss of performance. While I also upgraded snort and argus to newer versions at the same time as PF_RING, I find it less likely that both programs made changes to adversely affect packet capture rates at the same time. Are there any other reports of this happening? Anything I can do to help troubleshoot where this packet loss might be happening? I will file this on the bugzilla as well for tracking. Cheers, Jesse -- Jesse Bowling
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
