On Thu, Apr 17, 2014 at 4:59 PM, Michał Purzyński < [email protected]> wrote:
> Hello. > > I'm trying to write to disk between 3-7Gbit/sec (traffic changes a lot). > Netsniff-ng is dropping packets, at least that is what statistics say. > > Hardware and software details: > > 2 x E5-2620 > 64GB memory in 8 x 8 DIMMs to use every channel > Intel X520 based card > 12 x 3TB (2.7TB in fact) in RAID5 - 1 as hot spare, the rest gives me a > healthy 28TB usable > > Ubuntu 12.04 on 3.8.x kernel > XFS > > I run the software like this > > netsniff-ng -i eth2 -o /nsm/sensor_data/nsm2-eth2/dailylogs/2014-04-17/ > --user 2551 --group 2551 -s --prefix snort.log. --verbose --ring-size 4000 > iB --interval 1500 MiB --mmap --filter /etc/nsm/nsm2-eth2/bpf-pcap.ops > > BTW - there is a bug (integer overflow) and the buffer can't be larger > than 4095MB. Anyway. > My understanding is that it's not really a bug but due to the nature of mmap(), I have an issue created for that if something can be done about it. [1] > What can I do to make netsniff lossless in this situation? Can it even do > it? > You may attempt to try the suggestions in the following thread that speak of page/flush tuning and load balancing [2]. Mapping, say 64GB of RAM to a tmpfs mount point and writing to it may be worth a try as it may hint to the bottleneck (disk gets the blame often). > Also, I've disabled every kind of offloading feature I could find, and > build the new Intel drivers with LRO=0. > [1] https://github.com/netsniff-ng/netsniff-ng/issues/90 [2] https://groups.google.com/forum/#!msg/netsniff-ng/vPeYPZzh1Es Thanks -- Jon Schipp, jonschipp.com, sickbits.net -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
