Hi All,
I have strange situation and I'm looking for help.
I have two systems one with RHEL 6.3
2.6.32-279.9.1.el6.x86_64 #1 SMP Fri Aug 31 09:04:24 EDT 2012 x86_64 x86_64
x86_64 GNU/Linux
with netsniff from centos/epel repositories
netsniff-ng 0.5.5.0, netsniff-ng-0.5.5.0-2.el6.src.rpm
second one is the:
Grml Live Linux , version grml32-full_2013.02.iso
Linux 3.7-1-grml-486 #1 Debian 3.7.9-1+grml.1 i686 GNU/Linux
netsniff-ng 0.5.7
On the grml linux server everything is working fine, no drops.
but on the RHEL I got drops.
/usr/sbin/netsniff\-ng -d eth0 -p oooo.pcap -s
netsniff-ng 0.5.5.0 -- pid (20971)
nice (0), scheduler (0 prio 0)
8 of 8 CPUs online, affinity bitstring (10000000)
No filter applied. Switching to `all traffic`.
100.00 MB allocated for receive ring
[ 6400 blocks, 51200 frames ]
[ 8 frames per block ]
[ framesize: 2048 bytes, blocksize: 16384 bytes ]
--- Listening ---
Receive ring dumping ... |^Ccaught SIGINT!
Got SIGINT here!
67134 frames incoming
51201 frames passed filter
15933 frames failed filter (due to out of space)
capture file gets size 52910017 May 27 11:23 oooo.pcap
each try this sizes differ but still stays about 60M.
I connect with gdb to netsniff-ng process to see on what is hangs and I see:
#1 0x00000000004063a0 in fetch_packets (sd=0x7fff845f44a0, sock=4,
rb=0x1259050)
at rx_ring.c:300
300 while ((ret = poll(&pfd, 1, sd->blocking_mode)) <= 0) {
(gdb) s
Single stepping until exit from function poll,
which has no line number information.
The traffic I sniff in this test is ftp session ( ~ 90Mbits).
Maybe you can help me with finding the root of this issue ?
Is any system tuning needed to avoid such issue?
Thanks and Regards.
Irek
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/groups/opt_out.
