I've not seen any comments or updates on this issue. I'm still experiencing this issue and would appreciate any advice on how to troubleshoot, or at least some confirmation from other sites that they see this issue with 5.6.2 PF_RING?
Thanks, Jesse On Tue, Mar 25, 2014 at 2:14 PM, Jesse Bowling <[email protected]>wrote: > Hello, > > Recently I updated my sensors to use PF_RING 5.6.2, after a good long > while on an SVN version of 5.6.1. Initial results on a lightly loaded test > box were good, however when the same setup was loaded onto more heavily > loaded boxes we started seeing a substantial number of dropped packets. > > We use the ixgbe PF_RING aware drivers on RHEL 6. The > /proc/net/pf_ring/info reports: > > PF_RING Version : 5.6.2 ($Revision: exported$) > Total rings : 28 > > Standard (non DNA) Options > Ring slots : 16384 > Slot version : 15 > Capture TX : No [RX only] > IP Defragment : No > Socket Mode : Standard > Transparent mode : No [mode 2] > Total plugins : 0 > Cluster Fragment Queue : 32720 > Cluster Fragment Discard : 69173446 > > The Cluster Fragment Discard numbers are much larger than usual. > Additionally the NIC started reporting drops (less than 1%, but compared to > the previous setup which dropped 0 packets at the NIC). Finally, the snort > and argus processes running on top of this setup now report drops at a much > higher rate than before. Previously snort ran with 1% or less drops, argus > typically dropped only a few thousandths of a percent. Currently, snort is > reporting drops of 15-20%, and argus is seeing roughly 15% drops as well. > This is on a 10 Gb link with peaks of 1.8 Gb/sec with daytime averages of > 1.4 Gb/sec. Similar, although smaller, increases in dropped packets was > seen on another link that is much less loaded (300-500 Mb/sec, loss > typically in the 5-10% range). > > Overall this is a substantial loss of performance. While I also upgraded > snort and argus to newer versions at the same time as PF_RING, I find it > less likely that both programs made changes to adversely affect packet > capture rates at the same time. > > Are there any other reports of this happening? Anything I can do to help > troubleshoot where this packet loss might be happening? > > I will file this on the bugzilla as well for tracking. > > Cheers, > > Jesse > > -- > Jesse Bowling > > -- Jesse Bowling
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
