Would you also update the documentation on http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/ to reflect this? I followed these and this is what caused it. :(
On Mon, Oct 3, 2016 at 3:16 PM, Alfredo Cardigliano <[email protected]> wrote: > Please note “dummy” is a special name for cento, in this case it runs an > internal traffic generator able to > simulate a capture interface producing synthetic traffic in order to test > pure processing performance, in > essence the real interface is just ignored, please try renaming the > interface (before running zbalance/cento) with: > > ip link set dummy0 name myname0 > > Alfredo > > On 3 Oct 2016, at 19:07, Luca Deri <[email protected]> wrote: > > This looks like a bug. Please file an issue on > https://github.com/ntop/PF_RING/issues > > Luca > > On 3 Oct 2016, at 19:06, Jeremy Ashton <[email protected]> wrote: > > Here is the deal. If I configure zbalance_ipc listen on 4x interfaces > and then map those queues to dummy interfaces; Cento shows the > bandwidth 100x more than reality. i.e. it shows 27.91Gbps whereas it > is actually ~279 Mbit/s. > > pfcount on dummy0 interface: > $ sudo pfcount -i dummy0 -c 100 > > ========================= > Absolute Stats: [152'733 pkts total][0 pkts dropped][0.0% dropped] > [152'733 pkts rcvd][108'744'822 bytes rcvd][50'907.23 pkt/sec][289.96 > Mbit/sec] > ========================= > Actual Stats: [41'132 pkts rcvd][1'000.05 ms][41'129.73 pps][0.25 Gbps] > ========================= > > ========================= > Absolute Stats: [189'340 pkts total][0 pkts dropped][0.0% dropped] > [189'340 pkts rcvd][134'926'703 bytes rcvd][47'331.02 pkt/sec][269.83 > Mbit/sec] > ========================= > Actual Stats: [36'607 pkts rcvd][1'000.11 ms][36'602.82 pps][0.21 Gbps] > ========================= > > > cento on dummy0 interface (should be 1/4 of total bandwidth): > $ sudo /usr/local/bin/zbalance_ipc -i > zc:<int1>,zc:<int2>,zc:<int3>,zc:<int4> -c10 -n4 -m1 -g0 -u > /mnt/hugepages/ -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3 > $ sudo cento -i dummy0 > 03/Oct/2016 16:58:26 [NetworkInterface.cpp:990] [dummy0] [12'458'091 > pps/27.91 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX > pkt drops][0 TX pps] > 03/Oct/2016 16:58:27 [NetworkInterface.cpp:990] [dummy0] [12'447'559 > pps/27.88 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX > pkt drops][0 TX pps] > 03/Oct/2016 16:58:28 [NetworkInterface.cpp:990] [dummy0] [12'753'627 > pps/28.57 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX > pkt drops][0 TX pps] > 03/Oct/2016 16:58:29 [NetworkInterface.cpp:990] [dummy0] [12'385'380 > pps/27.74 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX > pkt drops][0 TX pps] > 03/Oct/2016 16:58:30 [NetworkInterface.cpp:990] [dummy0] [12’261'717 > pps/27.47 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX > pkt drops][0 TX pps] > > cento on raw interface with zc: > $ sudo cento -i zc:<int1> -i zc:<int2> -i zc:<int3> -i zc:<int4> -g > 1,2,3,4 -C 100 -H > 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int1>] [0 > pps/0.00 Gbps][3’966/0/0/512’000 act/exp/drop/max flows][137’492/0 > RX/TX pkt drops][0 TX pps] > 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int2>] [0 > pps/0.00 Gbps][1’960/0/0/512’000 act/exp/drop/max flows][34’004/0 > RX/TX pkt drops][0 TX pps] > 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int3>] [0 > pps/0.00 Gbps][9’583/0/0/512’000 act/exp/drop/max flows][125’445/0 > RX/TX pkt drops][0 TX pps] > 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int4>] [0 > pps/0.00 Gbps][1/0/0/512’000 act/exp/drop/max flows][0/0 RX/TX put > drops][0 TX pps] > > On Mon, Oct 3, 2016 at 10:14 AM, Luca Deri <[email protected]> wrote: > > Jeremy, > I annoy sure I understand. in essence you have attached cento to > zbalance_ipc queues, and the traffic rates are not correct? What you see > with pfcount instead? > > This said, what do you want to do exactly? Perhaps use cento as > flow-generator and attach bro to it on balanced egress queues? > > Regards luca > > On 3 Oct 2016, at 16:04, Jeremy Ashton <[email protected]> wrote: > > After following these instructions: > http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/ > > The actual command was like the following: > > zbalance_ipc -i zc:<link1>,zc:<link2>,zc:<link3>,zc:<link4> -n 4 -m 1 > -c 2 -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3 > > > I found it was reporting something like the following: > > 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy0] [8'854'686 > pps/19.83 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX > pkt drops][0 TX pps] > > 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy1] [18’428'232 > pps/41.28 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX > pkt drops][0 TX pps] > > > If I configure cento to listen to the interfaces directly, I see that > there is <5Gbit aggregate bandwidth. Is there something strange with > the way cento attempts to listen to dummy interfaces? > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
