Hi Alfredo
Thank you for your answer.
After loading driver with single queue, issues in Q2 and Q3 have been resolved.
Thank you!
What remains is Q4:
Question 4:
Tshark is now linked to PF_RING aware libpcap:
root@liproxy:/usr/lib/x86_64-linux-gnu# ldd /usr/bin/tshark |
grep libpcap
libpcap.so.0.8 => /usr/lib/x86_64-linux-gnu/libpcap.so.0.8
(0x00007f5b296ce000)
root@liproxy:/usr/lib/x86_64-linux-gnu# ls -lh | grep libpca
lrwxrwxrwx 1 root root 16 Dec 8 10:37 libpcap.so.0.8 ->
libpcap.so.1.1.1
-rwxr-xr-x 1 root root 596K Dec 8 09:24 libpcap.so.1.1.1
-rw-r--r-- 1 root root 232K Jun 13 2012 libpcap.so.1.3.0
When starting tshark dump we can see new line "Capturing on PF_RING", and a new
file in /proc/net/pf_ring.
Current problem we are having is that if we start tshark with "-i eth2", we can
see packets, but starting it with "-i zc:eth2" results in no packets. Is this
connected to question number 2 and 3? Are all packets dropped for some reason
and this is reason tshark doesn't see them?
>> Even after changing to single queue, tshark doesn't see packet if started
>> with zc:eth2.
Addition: Question 5
Drops when using pcount with zc:eht2. This test was done after changing to
single queue.
Pcount result when using "-i eth2":
root@liproxy:/opt/PF_RING-6.0.2/userland/examples#<mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples#>
./pcount -i eth2
Capturing from eth5
=========================
Absolute Stats: [902633 pkts rcvd][0 pkts dropped]
Total Pkts=902633/Dropped=0.0 %
902633 pkts [905652.4 pkt/sec] - 768257468 bytes [6166.62 Mbit/sec]
=========================
=========================
Absolute Stats: [1653917 pkts rcvd][0 pkts dropped]
Total Pkts=1653917/Dropped=0.0 %
1653917 pkts [828302.8 pkt/sec] - 1406209160 bytes [5633.98 Mbit/sec]
=========================
Actual Stats: 1'653'917 pkts [1000.1 ms][1'653'771.50 pkt/sec]
=========================
=========================
Absolute Stats: [2402999 pkts rcvd][0 pkts dropped]
Total Pkts=2402999/Dropped=0.0 %
2402999 pkts [801831.1 pkt/sec] - 2049090798 bytes [5469.91 Mbit/sec]
=========================
Actual Stats: 749'082 pkts [1000.1 ms][748'980.92 pkt/sec]
=========================
Result when using "-i zc:eth2":
root@liproxy:/opt/PF_RING-6.0.2/userland/examples#<mailto:root@liproxy:/opt/PF_RING-6.0.2/userland/examples#>
./pcount -i zc:eth2
=========================
Absolute Stats: [729018 pkts rcvd][161067 pkts dropped]
Total Pkts=567951/Dropped=22.1 %
729018 pkts [1165250.5 pkt/sec] - 606789379 bytes [7759.06 Mbit/sec]
=========================
=========================
Absolute Stats: [1853747 pkts rcvd][161067 pkts dropped]
Total Pkts=1692680/Dropped=8.7 %
1853747 pkts [1140181.5 pkt/sec] - 1546317882 bytes [7608.73 Mbit/sec]
=========================
Actual Stats: 1'853'747 pkts [1000.2 ms][1'853'370.74 pkt/sec]
=========================
=========================
Absolute Stats: [2963170 pkts rcvd][161067 pkts dropped]
Total Pkts=2802103/Dropped=5.4 %
2963170 pkts [1128395.9 pkt/sec] - 2472909764 bytes [7533.61 Mbit/sec]
=========================
Actual Stats: 1'109'423 pkts [1000.2 ms][1'109'237.74 pkt/sec]
=========================
=========================
Absolute Stats: [4046292 pkts rcvd][161067 pkts dropped]
Total Pkts=3885225/Dropped=4.0 %
4046291 pkts [1115861.7 pkt/sec] - 3374447819 bytes [7444.68 Mbit/sec]
=========================
Can you please answer Q4 and Q5 as soon as possible?
Thank you,
Katarina Valent
From: [email protected]
[mailto:[email protected]] On Behalf Of Alfredo Cardigliano
Sent: Thursday, December 11, 2014 10:48 AM
To: [email protected]
Cc: Alan Klikić
Subject: Re: [Ntop-misc] PF_RING ZC and jnetpcap
Hi Katarina
Q1: yes, if you use latest code from SVN you will see “ZC”
Q2-4: please make sure the driver is loaded with a single queue (RSS=1,1,1,1),
probably you have multiple queues and capturing from the first only (zc:eth2 ==
zc:eth2@0)
Alfredo
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc
