> On 16 Dec 2014, at 01:49, Jesse Bowling <[email protected]> wrote: > > > On Dec 12, 2014, at 5:55 PM, Alfredo Cardigliano <[email protected]> wrote: > >> >>> On 12 Dec 2014, at 20:44, Jesse Bowling <[email protected]> wrote: >>> >>> In the vanilla PF_RING world, one could look under /proc/net/pf_ring and >>> find files for each process using PF_RING, and these files contained >>> information on packets seen, dropped, processed, as well as memory >>> information. I’d like to know if there are similar things when using the ZC >>> drivers. >> >> With ZC kernel is bypassed, this means the application reads stats directly >> from the NIC, and usually print them under /proc/net/pf_ring/stats > > OK, perfect! > >> >>> I did find that when using the zbalance_ipc example program to bind two >>> interfaces together and then deliver that information to a single process >>> there was a file under /proc/net/pf_ring/stats for the process, but it did >>> not see to contain useful information in terms of performance. >>> >>> What is the recommended way to obtain statistics on ZC performance (or >>> really, app performance using ZC)? >> >> /proc is the way, please let us know what is missing under /stats that you >> think is useful > > I suppose I got used to the way that PF_RING would let you know how the app > was performing; in other words, if my snort instances were consuming too > slowly and packets in the ring were being overwritten before being read, I > could see that in the “drop” counts...Or perhaps the issue that was really > being reported was that PF_RING was dropping the packets before they could be > inserted in the ring? Either way, I liked being able to get a sense of my > apps performance via the PF_RING stats. It seems like the new stats don’t > really give you that info…
If your snort instances are consuming too slowly, incoming packets are being discarded. Snort is able to read stats about discarded packets through the DAQ-ZC. Alfredo >> >>> I notice zbalance_ipc does print statistics to the screen while running; >>> can these be disabled? >> >> There is no parameter at the moment, but they are not printed in daemon mode. > > Ah! I was missing the daemon mode flag... >> >>> Would you expect zbalance_ipc to be used in a similar fashion as >>> pfdnaclustermaster was for DNA? >> >> Yes, they are supposed to be equivalent, do think zbalance_ipc is missing >> useful features available in pfdnaclustermaster? > > Really just getting started with this, and wanted to make sure I was on the > correct track! > > Thank you so much for your replies! > > Cheers, > > Jesse > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
