Currently I need to use zbalance_ipc because cento does not currently support multiple aggregated-egress-queues. Our use case is as follows:
We have a number of 10Gbps links which are being aggregated by zbalance_ipc and then it creates (n) aggregated queues. One of the queues is connected to cento and then n2disk (via aggregated-egress-queue) and also bro through balanced-egress-queue. Another of the aggregated queues is made available as a test port for tcpdump. This is certainly not ideal but it is all we can do in the meantime. On Mon, Oct 3, 2016 at 3:45 PM, Alfredo Cardigliano <[email protected]> wrote: > Hi Jeremy > please note the post is correct and it still applies to PF_RING/ZC, > your issue is due to a name clash in Cento. > BTW, what do you want to do in practice? Why are you using zbalance with > cento? > > Alfredo > >> On 3 Oct 2016, at 21:40, Jeremy Ashton <[email protected]> wrote: >> >> Would you also update the documentation on >> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/ >> to reflect this? I followed these and this is what caused it. :( >> >> On Mon, Oct 3, 2016 at 3:16 PM, Alfredo Cardigliano >> <[email protected]> wrote: >>> Please note “dummy” is a special name for cento, in this case it runs an >>> internal traffic generator able to >>> simulate a capture interface producing synthetic traffic in order to test >>> pure processing performance, in >>> essence the real interface is just ignored, please try renaming the >>> interface (before running zbalance/cento) with: >>> >>> ip link set dummy0 name myname0 >>> >>> Alfredo >>> >>> On 3 Oct 2016, at 19:07, Luca Deri <[email protected]> wrote: >>> >>> This looks like a bug. Please file an issue on >>> https://github.com/ntop/PF_RING/issues >>> >>> Luca >>> >>> On 3 Oct 2016, at 19:06, Jeremy Ashton <[email protected]> wrote: >>> >>> Here is the deal. If I configure zbalance_ipc listen on 4x interfaces >>> and then map those queues to dummy interfaces; Cento shows the >>> bandwidth 100x more than reality. i.e. it shows 27.91Gbps whereas it >>> is actually ~279 Mbit/s. >>> >>> pfcount on dummy0 interface: >>> $ sudo pfcount -i dummy0 -c 100 >>> >>> ========================= >>> Absolute Stats: [152'733 pkts total][0 pkts dropped][0.0% dropped] >>> [152'733 pkts rcvd][108'744'822 bytes rcvd][50'907.23 pkt/sec][289.96 >>> Mbit/sec] >>> ========================= >>> Actual Stats: [41'132 pkts rcvd][1'000.05 ms][41'129.73 pps][0.25 Gbps] >>> ========================= >>> >>> ========================= >>> Absolute Stats: [189'340 pkts total][0 pkts dropped][0.0% dropped] >>> [189'340 pkts rcvd][134'926'703 bytes rcvd][47'331.02 pkt/sec][269.83 >>> Mbit/sec] >>> ========================= >>> Actual Stats: [36'607 pkts rcvd][1'000.11 ms][36'602.82 pps][0.21 Gbps] >>> ========================= >>> >>> >>> cento on dummy0 interface (should be 1/4 of total bandwidth): >>> $ sudo /usr/local/bin/zbalance_ipc -i >>> zc:<int1>,zc:<int2>,zc:<int3>,zc:<int4> -c10 -n4 -m1 -g0 -u >>> /mnt/hugepages/ -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3 >>> $ sudo cento -i dummy0 >>> 03/Oct/2016 16:58:26 [NetworkInterface.cpp:990] [dummy0] [12'458'091 >>> pps/27.91 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX >>> pkt drops][0 TX pps] >>> 03/Oct/2016 16:58:27 [NetworkInterface.cpp:990] [dummy0] [12'447'559 >>> pps/27.88 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX >>> pkt drops][0 TX pps] >>> 03/Oct/2016 16:58:28 [NetworkInterface.cpp:990] [dummy0] [12'753'627 >>> pps/28.57 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX >>> pkt drops][0 TX pps] >>> 03/Oct/2016 16:58:29 [NetworkInterface.cpp:990] [dummy0] [12'385'380 >>> pps/27.74 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX >>> pkt drops][0 TX pps] >>> 03/Oct/2016 16:58:30 [NetworkInterface.cpp:990] [dummy0] [12’261'717 >>> pps/27.47 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX >>> pkt drops][0 TX pps] >>> >>> cento on raw interface with zc: >>> $ sudo cento -i zc:<int1> -i zc:<int2> -i zc:<int3> -i zc:<int4> -g >>> 1,2,3,4 -C 100 -H >>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int1>] [0 >>> pps/0.00 Gbps][3’966/0/0/512’000 act/exp/drop/max flows][137’492/0 >>> RX/TX pkt drops][0 TX pps] >>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int2>] [0 >>> pps/0.00 Gbps][1’960/0/0/512’000 act/exp/drop/max flows][34’004/0 >>> RX/TX pkt drops][0 TX pps] >>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int3>] [0 >>> pps/0.00 Gbps][9’583/0/0/512’000 act/exp/drop/max flows][125’445/0 >>> RX/TX pkt drops][0 TX pps] >>> 03/Oct/2016 16:59:38 [NetworkInterface.cpp:990] [zc:<int4>] [0 >>> pps/0.00 Gbps][1/0/0/512’000 act/exp/drop/max flows][0/0 RX/TX put >>> drops][0 TX pps] >>> >>> On Mon, Oct 3, 2016 at 10:14 AM, Luca Deri <[email protected]> wrote: >>> >>> Jeremy, >>> I annoy sure I understand. in essence you have attached cento to >>> zbalance_ipc queues, and the traffic rates are not correct? What you see >>> with pfcount instead? >>> >>> This said, what do you want to do exactly? Perhaps use cento as >>> flow-generator and attach bro to it on balanced egress queues? >>> >>> Regards luca >>> >>> On 3 Oct 2016, at 16:04, Jeremy Ashton <[email protected]> wrote: >>> >>> After following these instructions: >>> http://www.ntop.org/pf_ring/best-practices-for-using-bro_ids-with-pf_ring-zc-reliably/ >>> >>> The actual command was like the following: >>> >>> zbalance_ipc -i zc:<link1>,zc:<link2>,zc:<link3>,zc:<link4> -n 4 -m 1 >>> -c 2 -r 0:dummy0 -r 1:dummy1 -r 2:dummy2 -r 3:dummy3 >>> >>> >>> I found it was reporting something like the following: >>> >>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy0] [8'854'686 >>> pps/19.83 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX >>> pkt drops][0 TX pps] >>> >>> 27/Sep/2016 18:17:56 [NetworkInterface.cpp:990] [dummy1] [18’428'232 >>> pps/41.28 Gbps][29'412/0/0/512'000 act/exp/drop/max flows][0/0 RX/TX >>> pkt drops][0 TX pps] >>> >>> >>> If I configure cento to listen to the interfaces directly, I see that >>> there is <5Gbit aggregate bandwidth. Is there something strange with >>> the way cento attempts to listen to dummy interfaces? >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>> >>> >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>> >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>> >>> >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >>> >>> >>> >>> _______________________________________________ >>> Ntop-misc mailing list >>> [email protected] >>> http://listgateway.unipi.it/mailman/listinfo/ntop-misc >> _______________________________________________ >> Ntop-misc mailing list >> [email protected] >> http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc _______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
