On Dec 12, 2014, at 5:55 PM, Alfredo Cardigliano <[email protected]> wrote:

> 
>> On 12 Dec 2014, at 20:44, Jesse Bowling <[email protected]> wrote:
>> 
>> In the vanilla PF_RING world, one could look under /proc/net/pf_ring and 
>> find files for each process using PF_RING, and these files contained 
>> information on packets seen, dropped, processed, as well as memory 
>> information. I’d like to know if there are similar things when using the ZC 
>> drivers.
> 
> With ZC kernel is bypassed, this means the application reads stats directly 
> from the NIC, and usually print them under /proc/net/pf_ring/stats

OK, perfect!

> 
>> I did find that when using the zbalance_ipc example program to bind two 
>> interfaces together and then deliver that information to a single process 
>> there was a file under /proc/net/pf_ring/stats for the process, but it did 
>> not see to contain useful information in terms of performance.
>> 
>> What is the recommended way to obtain statistics on ZC performance (or 
>> really, app performance using ZC)?
> 
> /proc is the way, please let us know what is missing under /stats that you 
> think is useful

I suppose I got used to the way that PF_RING would let you know how the app was 
performing; in other words, if my snort instances were consuming too slowly and 
packets in the ring were being overwritten before being read, I could see that 
in the “drop” counts...Or perhaps the issue that was really being reported was 
that PF_RING was dropping the packets before they could be inserted in the 
ring? Either way, I liked being able to get a sense of my apps performance via 
the PF_RING stats. It seems like the new stats don’t really give you that 
info...

> 
>> I notice zbalance_ipc does print statistics to the screen while running; can 
>> these be disabled?
> 
> There is no parameter at the moment, but they are not printed in daemon mode.

Ah! I was missing the daemon mode flag...
> 
>> Would you expect zbalance_ipc to be used in a similar fashion as 
>> pfdnaclustermaster was for DNA? 
> 
> Yes, they are supposed to be equivalent, do think zbalance_ipc is missing 
> useful features available in pfdnaclustermaster?

Really just getting started with this, and wanted to make sure I was on the 
correct track!

Thank you so much for your replies!

Cheers,

Jesse
_______________________________________________
Ntop-misc mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-misc

Reply via email to