Hi Katarina Q1: yes, if you use latest code from SVN you will see “ZC” Q2-4: please make sure the driver is loaded with a single queue (RSS=1,1,1,1), probably you have multiple queues and capturing from the first only (zc:eth2 == zc:eth2@0)
Alfredo > On 09 Dec 2014, at 11:23, Katarina Valent <[email protected]> > wrote: > > Hi Alfredo > > We are seeing some strange behavior when using ZC. Could you please help us? > > Question 1: > If we use device zc:eth2 in /proc Breed is "DNA". Does this mean that ZC is > started? > > Question 2: > We see drops when using zcount with zc:eth2. > Zcount result when using "-i eth2": > root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc# > <mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc#> ./zcount -i > eth2 -c 0 > ========================= > Absolute Stats: 1'124'466 pkts (0 drops) - 1'254'541'605 bytes > ========================= > > ========================= > Absolute Stats: 2'254'557 pkts (0 drops) - 2'508'476'311 bytes > Actual Stats: 1'129'959.92 pps (0.00 drops) - 10.03 Gbps > ========================= > > Result when using "-i zc:eth2": > root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc# > <mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples_zc#> ./zcount -i > zc:eth2 -c 0 > ========================= > Absolute Stats: 114'616 pkts (1'037'590 drops) - 124'729'238 bytes > ========================= > > ========================= > Absolute Stats: 114'616 pkts (2'175'107 drops) - 124'729'238 bytes > Actual Stats: 0.00 pps (1'137'371.41 drops) - 0.00 Gbps > ========================= > Why does using ZC result in packet dropping? > > Question 3: > We don't see any packets when using pfcount with "zc:eth2" > Result when using "-i eth2": > root@liproxy:/opt/PF_RING-6.0.2/userland/examples# > <mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples#> ./pfcount -i eth2 > Using PF_RING v.6.0.2 > Capturing from eth2 [90:E2:BA:80:F3:65][ifIndex: 9] > # Device RX channels: 2 > # Polling threads: 1 > Dumping statistics on /proc/net/pf_ring/stats/7104-eth2.130 > ========================= > Absolute Stats: [1124316 pkts rcvd][0 pkts dropped] > Total Pkts=1124316/Dropped=0.0 % > 1'124'316 pkts - 1'254'292'710 bytes > ========================= > > ========================= > Absolute Stats: [2263575 pkts rcvd][0 pkts dropped] > Total Pkts=2263575/Dropped=0.0 % > 2'263'575 pkts - 2'509'016'300 bytes [2'263'079.38 pkt/sec - 20'067.73 > Mbit/sec] > ========================= > Actual Stats: 1139259 pkts [1'000.21 ms][1'139'009.55 pps/10.04 Gbps] > ========================= > > ========================= > Absolute Stats: [3421860 pkts rcvd][0 pkts dropped] > Total Pkts=3421860/Dropped=0.0 % > 3'421'860 pkts - 3'763'681'863 bytes [1'710'643.46 pkt/sec - 15'052.20 > Mbit/sec] > ========================= > Actual Stats: 1158285 pkts [1'000.11 ms][1'158'150.65 pps/10.04 Gbps] > ========================= > > Result when using "-i zc:eth2": > root@liproxy:/opt/PF_RING-6.0.2/userland/examples# > <mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples#> ./pfcount -i > zc:eth2 > Using PF_RING v.6.0.2 > Capturing from zc:eth2 [90:E2:BA:80:F3:65][ifIndex: 9] > # Device RX channels: 2 > # Polling threads: 1 > Dumping statistics on /proc/net/pf_ring/stats/6919-eth2.94 > ========================= > Absolute Stats: [0 pkts rcvd][1051691 pkts dropped] > Total Pkts=1051691/Dropped=0.0 % > 0 pkts - 0 bytes > ========================= > > ========================= > Absolute Stats: [0 pkts rcvd][2205303 pkts dropped] > Total Pkts=2205303/Dropped=0.0 % > 0 pkts - 0 bytes [0.00 pkt/sec - 0.00 Mbit/sec] > ========================= > Actual Stats: 0 pkts [1'000.08 ms][0.00 pps/0.00 Gbps] > ========================= > Why does ZC have worse result than non-ZC? > > Question 4: > Tshark is now linked to PF_RING aware libpcap: > root@liproxy:/usr/lib/x86_64-linux-gnu# ldd /usr/bin/tshark | > grep libpcap > libpcap.so.0.8 => /usr/lib/x86_64-linux-gnu/libpcap.so.0.8 > (0x00007f5b296ce000) > root@liproxy:/usr/lib/x86_64-linux-gnu# ls -lh | grep libpca > lrwxrwxrwx 1 root root 16 Dec 8 10:37 libpcap.so.0.8 -> > libpcap.so.1.1.1 > -rwxr-xr-x 1 root root 596K Dec 8 09:24 libpcap.so.1.1.1 > -rw-r--r-- 1 root root 232K Jun 13 2012 libpcap.so.1.3.0 > When starting tshark dump we can see new line "Capturing on PF_RING", and a > new file in /proc/net/pf_ring. > Current problem we are having is that if we start tshark with "-i eth2", we > can see packets, but starting it with "-i zc:eth2" results in no packets. Is > this connected to question number 2 and 3? Are all packets dropped for some > reason and this is reason tshark doesn't see them? > > Can you please answer all four qeustions? > > Thank you, > Katarina Valent > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
