Hi Alfredo
We are seeing some strange behavior when using ZC. Could you please help us?
Question 1:
If we use device zc:eth2 in /proc Breed is "DNA". Does this mean that ZC is
started?
Question 2:
We see drops when using zcount with zc:eth2.
Zcount result when using "-i eth2":
root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc#<mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc#>
./zcount -i eth2 -c 0
=========================
Absolute Stats: 1'124'466 pkts (0 drops) - 1'254'541'605 bytes
=========================
=========================
Absolute Stats: 2'254'557 pkts (0 drops) - 2'508'476'311 bytes
Actual Stats: 1'129'959.92 pps (0.00 drops) - 10.03 Gbps
=========================
Result when using "-i zc:eth2":
root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc#<mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc#>
./zcount -i zc:eth2 -c 0
=========================
Absolute Stats: 114'616 pkts (1'037'590 drops) - 124'729'238 bytes
=========================
=========================
Absolute Stats: 114'616 pkts (2'175'107 drops) - 124'729'238 bytes
Actual Stats: 0.00 pps (1'137'371.41 drops) - 0.00 Gbps
=========================
Why does using ZC result in packet dropping?
Question 3:
We don't see any packets when using pfcount with "zc:eth2"
Result when using "-i eth2":
root@liproxy:/opt/PF_RING-6.0.2/userland/examples#<mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples#>
./pfcount -i eth2
Using PF_RING v.6.0.2
Capturing from eth2 [90:E2:BA:80:F3:65][ifIndex: 9]
# Device RX channels: 2
# Polling threads: 1
Dumping statistics on /proc/net/pf_ring/stats/7104-eth2.130
=========================
Absolute Stats: [1124316 pkts rcvd][0 pkts dropped]
Total Pkts=1124316/Dropped=0.0 %
1'124'316 pkts - 1'254'292'710 bytes
=========================
=========================
Absolute Stats: [2263575 pkts rcvd][0 pkts dropped]
Total Pkts=2263575/Dropped=0.0 %
2'263'575 pkts - 2'509'016'300 bytes [2'263'079.38 pkt/sec - 20'067.73
Mbit/sec]
=========================
Actual Stats: 1139259 pkts [1'000.21 ms][1'139'009.55 pps/10.04 Gbps]
=========================
=========================
Absolute Stats: [3421860 pkts rcvd][0 pkts dropped]
Total Pkts=3421860/Dropped=0.0 %
3'421'860 pkts - 3'763'681'863 bytes [1'710'643.46 pkt/sec - 15'052.20
Mbit/sec]
=========================
Actual Stats: 1158285 pkts [1'000.11 ms][1'158'150.65 pps/10.04 Gbps]
=========================
Result when using "-i zc:eth2":
root@liproxy:/opt/PF_RING-6.0.2/userland/examples#<mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples#>
./pfcount -i zc:eth2
Using PF_RING v.6.0.2
Capturing from zc:eth2 [90:E2:BA:80:F3:65][ifIndex: 9]
# Device RX channels: 2
# Polling threads: 1
Dumping statistics on /proc/net/pf_ring/stats/6919-eth2.94
=========================
Absolute Stats: [0 pkts rcvd][1051691 pkts dropped]
Total Pkts=1051691/Dropped=0.0 %
0 pkts - 0 bytes
=========================
=========================
Absolute Stats: [0 pkts rcvd][2205303 pkts dropped]
Total Pkts=2205303/Dropped=0.0 %
0 pkts - 0 bytes [0.00 pkt/sec - 0.00 Mbit/sec]
=========================
Actual Stats: 0 pkts [1'000.08 ms][0.00 pps/0.00 Gbps]
=========================
Why does ZC have worse result than non-ZC?
Question 4:
Tshark is now linked to PF_RING aware libpcap:
root@liproxy:/usr/lib/x86_64-linux-gnu# ldd /usr/bin/tshark |
grep libpcap
libpcap.so.0.8 => /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
(0x00007f5b296ce000)
root@liproxy:/usr/lib/x86_64-linux-gnu# ls -lh | grep libpca
lrwxrwxrwx 1 root root 16 Dec 8 10:37 libpcap.so.0.8 ->
libpcap.so.1.1.1
-rwxr-xr-x 1 root root 596K Dec 8 09:24 libpcap.so.1.1.1
-rw-r--r-- 1 root root 232K Jun 13 2012 libpcap.so.1.3.0
When starting tshark dump we can see new line "Capturing on PF_RING", and a new
file in /proc/net/pf_ring.
Current problem we are having is that if we start tshark with "-i eth2", we can
see packets, but starting it with "-i zc:eth2" results in no packets. Is this
connected to question number 2 and 3? Are all packets dropped for some reason
and this is reason tshark doesn't see them?
Can you please answer all four qeustions?
Thank you,
Katarina Valent
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
