Hi all, I have been using netsniff-ng for some time now and am very excited about packet fanout feature.
Have one AF_PACKET hash fanout functionality related question if somebody has time to comment : how can I get 3 or more netsniff-ng instances in one fanout-group output into 1 single PCAP file ? So far, I have tried to start 3 instances with : sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --mmap --ring-size 256MiB --bind-cpu 18 --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix "eth5." --interval 60sec & sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --mmap --ring-size 256MiB --bind-cpu 20 --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix "eth5." --interval 60sec & sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --mmap --ring-size 256MiB --bind-cpu 22 --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix "eth5." --interval 60sec & However, since interval isn't exactly 60 seconds, after 1-2 days I end up with separate output files, like : -rw-r--r-- 1 root root 135M Apr 30 14:44 /mnt/sdb1/netcapture/eth5.1430405040.pcap -rw-r--r-- 1 root root 125M Apr 30 14:44 /mnt/sdb1/netcapture/eth5.1430405041.pcap $ tcpslice /mnt/sdb1/netcapture/eth5.1430404980.pcap -t /mnt/sdb1/netcapture/eth5.1430404980.pcap 2015y04m30d14h43m00s733651u 2015y04m30d14h44m00s742344u $ tcpslice /mnt/sdb1/netcapture/eth5.1430404981.pcap -t /mnt/sdb1/netcapture/eth5.1430404981.pcap 2015y04m30d14h43m01s118241u 2015y04m30d14h44m01s138441u Am I doing something wrong the way I start instances, is there different way to start 3 instances to write into single output pcap file ? Also, I was wondering if there are any plans to make command line ability to start multiple instances using something like one command line with --bind-cpu 18,20,22 and one --out file, which would trigger 3 netsniff-ng instances while output goes into single output pcap file ? ( SolarCapture/SolarFlare uses that approach with multiple capture cores and one writeout core ) Let me know if you need more details. Best Regards Ivan -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
