Here is the deal. If I configure zbalance_ipc listen on 4x interfaces and then map those queues to dummy interfaces; Cento shows the bandwidth 100x more than reality. i.e. it shows 27.91Gbps whereas it is actually ~279 Mbit/s.
pfcount on dummy0 interface: $ sudo pfcount -i dummy0 -c 100 ========================= Absolute Stats: [152'733 pkts total][0 pkts dropped][0.0% dropped] [152'733 pkts rcvd][108'744'822 bytes rcvd][50'907.23 pkt/sec][289.96 Mbit/sec] ========================= Actual Stats: [41'132 pkts rcvd][1'000.05 ms][41'129.73 pps][0.25 Gbps] ========================= ========================= Absolute Stats: [189'340 pkts total][0 pkts dropped][0.0% dropped] [189'340 pkts rcvd][134'926'703 bytes rcvd][47'331.02 pkt/sec][269.83 Mbit/sec] ========================= Actual Stats: [36'607 pkts rcvd][1'000.11 ms][36'602.82 pps][0.21 Gbps] ========================= cento on dummy0 interface (should be 1/4 of total bandwidth): $ sudo /usr/local/bin/zbalance_ipc -i zc:<int1>,zc:<int2>,zc:<int3>,zc:<int4> -c10 -n4 -m1 -g0 -u /mnt/hugepages/ -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3 $ sudo cento -i dummy0 03/Oct/2016 16:58:26 [NetworkInterface.cpp:990] [dummy0] [12'458'091 pps/27.91 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX pkt drops][0 TX pps] 03/Oct/2016 16:58:27 [NetworkInterface.cpp:990] [dummy0] [12'447'559 pps/27.88 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX pkt drops][0 TX pps] 03/Oct/2016 16:58:28 [NetworkInterface.cpp:990] [dummy0] [12'753'627 pps/28.57 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX pkt drops][0 TX pps] 03/Oct/2016 16:58:29 [NetworkInterface.cpp:990] [dummy0] [12'385'380 pps/27.74 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX pkt drops][0 TX pps] 03/Oct/2016 16:58:30 [NetworkInterface.cpp:990] [dummy0] [12’261'717 pps/27.47 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX pkt drops][0 TX pps] cento on raw interface with zc: $ sudo cento -i zc:<int1> -i zc:<int2> -i zc:<int3> -i zc:<int4> -g 1,2,3,4 -C 100 -H 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int1>] [0 pps/0.00 Gbps][3’966/0/0/512’000 act/exp/drop/max flows][137’492/0 RX/TX pkt drops][0 TX pps] 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int2>] [0 pps/0.00 Gbps][1’960/0/0/512’000 act/exp/drop/max flows][34’004/0 RX/TX pkt drops][0 TX pps] 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int3>] [0 pps/0.00 Gbps][9’583/0/0/512’000 act/exp/drop/max flows][125’445/0 RX/TX pkt drops][0 TX pps] 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int4>] [0 pps/0.00 Gbps][1/0/0/512’000 act/exp/drop/max flows][0/0 RX/TX put drops][0 TX pps] On Mon, Oct 3, 2016 at 10:14 AM, Luca Deri <[email protected]> wrote: > Jeremy, > I annoy sure I understand. in essence you have attached cento to zbalance_ipc > queues, and the traffic rates are not correct? What you see with pfcount > instead? > > This said, what do you want to do exactly? Perhaps use cento as > flow-generator and attach bro to it on balanced egress queues? > > Regards luca > >> On 3 Oct 2016, at 16:04, Jeremy Ashton <[email protected]> wrote: >> >> After following these instructions: >> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/ >> >> The actual command was like the following: >> >> zbalance_ipc -i zc:<link1>,zc:<link2>,zc:<link3>,zc:<link4> -n 4 -m 1 >> -c 2 -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3 >> >> >> I found it was reporting something like the following: >> >> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy0] [8'854'686 >> pps/19.83 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX >> pkt drops][0 TX pps] >> >> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy1] [18’428'232 >> pps/41.28 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX >> pkt drops][0 TX pps] >> >> >> If I configure cento to listen to the interfaces directly, I see that >> there is <5Gbit aggregate bandwidth. Is there something strange with >> the way cento attempts to listen to dummy interfaces? >> _______________________________________________ >> Ntop-misc mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
