Hi Alfredo Can you please answer my questions asap?
Br, Katarina Valent From: [email protected] [mailto:[email protected]] On Behalf Of Katarina Valent Sent: Tuesday, December 09, 2014 11:24 AM To: [email protected] Cc: Alan Klikić Subject: Re: [Ntop-misc] PF_RING ZC and jnetpcap Hi Alfredo We are seeing some strange behavior when using ZC. Could you please help us? Question 1: If we use device zc:eth2 in /proc Breed is "DNA". Does this mean that ZC is started? Question 2: We see drops when using zcount with zc:eth2. Zcount result when using "-i eth2": root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc#<mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc> ./zcount -i eth2 -c 0 ========================= Absolute Stats: 1'124'466 pkts (0 drops) - 1'254'541'605 bytes ========================= ========================= Absolute Stats: 2'254'557 pkts (0 drops) - 2'508'476'311 bytes Actual Stats: 1'129'959.92 pps (0.00 drops) - 10.03 Gbps ========================= Result when using "-i zc:eth2": root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc#<mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc> ./zcount -i zc:eth2 -c 0 ========================= Absolute Stats: 114'616 pkts (1'037'590 drops) - 124'729'238 bytes ========================= ========================= Absolute Stats: 114'616 pkts (2'175'107 drops) - 124'729'238 bytes Actual Stats: 0.00 pps (1'137'371.41 drops) - 0.00 Gbps ========================= Why does using ZC result in packet dropping? Question 3: We don't see any packets when using pfcount with "zc:eth2" Result when using "-i eth2": root@liproxy:/opt/PF_RING-6.0.2/userland/examples#<mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples> ./pfcount -i eth2 Using PF_RING v.6.0.2 Capturing from eth2 [90:E2:BA:80:F3:65][ifIndex: 9] # Device RX channels: 2 # Polling threads: 1 Dumping statistics on /proc/net/pf_ring/stats/7104-eth2.130 ========================= Absolute Stats: [1124316 pkts rcvd][0 pkts dropped] Total Pkts=1124316/Dropped=0.0 % 1'124'316 pkts - 1'254'292'710 bytes ========================= ========================= Absolute Stats: [2263575 pkts rcvd][0 pkts dropped] Total Pkts=2263575/Dropped=0.0 % 2'263'575 pkts - 2'509'016'300 bytes [2'263'079.38 pkt/sec - 20'067.73 Mbit/sec] ========================= Actual Stats: 1139259 pkts [1'000.21 ms][1'139'009.55 pps/10.04 Gbps] ========================= ========================= Absolute Stats: [3421860 pkts rcvd][0 pkts dropped] Total Pkts=3421860/Dropped=0.0 % 3'421'860 pkts - 3'763'681'863 bytes [1'710'643.46 pkt/sec - 15'052.20 Mbit/sec] ========================= Actual Stats: 1158285 pkts [1'000.11 ms][1'158'150.65 pps/10.04 Gbps] ========================= Result when using "-i zc:eth2": root@liproxy:/opt/PF_RING-6.0.2/userland/examples#<mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples> ./pfcount -i zc:eth2 Using PF_RING v.6.0.2 Capturing from zc:eth2 [90:E2:BA:80:F3:65][ifIndex: 9] # Device RX channels: 2 # Polling threads: 1 Dumping statistics on /proc/net/pf_ring/stats/6919-eth2.94 ========================= Absolute Stats: [0 pkts rcvd][1051691 pkts dropped] Total Pkts=1051691/Dropped=0.0 % 0 pkts - 0 bytes ========================= ========================= Absolute Stats: [0 pkts rcvd][2205303 pkts dropped] Total Pkts=2205303/Dropped=0.0 % 0 pkts - 0 bytes [0.00 pkt/sec - 0.00 Mbit/sec] ========================= Actual Stats: 0 pkts [1'000.08 ms][0.00 pps/0.00 Gbps] ========================= Why does ZC have worse result than non-ZC? Question 4: Tshark is now linked to PF_RING aware libpcap: root@liproxy:/usr/lib/x86_64-linux-gnu# ldd /usr/bin/tshark | grep libpcap libpcap.so.0.8 => /usr/lib/x86_64-linux-gnu/libpcap.so.0.8 (0x00007f5b296ce000) root@liproxy:/usr/lib/x86_64-linux-gnu# ls -lh | grep libpca lrwxrwxrwx 1 root root 16 Dec 8 10:37 libpcap.so.0.8 -> libpcap.so.1.1.1 -rwxr-xr-x 1 root root 596K Dec 8 09:24 libpcap.so.1.1.1 -rw-r--r-- 1 root root 232K Jun 13 2012 libpcap.so.1.3.0 When starting tshark dump we can see new line "Capturing on PF_RING", and a new file in /proc/net/pf_ring. Current problem we are having is that if we start tshark with "-i eth2", we can see packets, but starting it with "-i zc:eth2" results in no packets. Is this connected to question number 2 and 3? Are all packets dropped for some reason and this is reason tshark doesn't see them? Can you please answer all four qeustions? Thank you, Katarina Valent
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
