Hi Ivan,
On 04/30/2015 05:28 PM, [email protected] wrote:
Hi all,
I have been using netsniff-ng for some time now and am very excited about
packet fanout feature.
Cool, great to hear! :)
Have one AF_PACKET hash fanout functionality related question if somebody has
time to comment :
how can I get 3 or more netsniff-ng instances in one fanout-group output into 1
single PCAP file ?
You below command-line invocation looks good to me. Letting all processes
write into one single pcap file at one, I'm afraid, won't work. There are
various reasons, i.e. it would corrupt the pcap file as there's no
synchronization between the processes to write a single packet atomically
into the pcap.
You also wouldn't want to do that. ;) Because assume if such a possibility
would exist, then the bottleneck becomes easily the write to disc on that
single file.
You rather want to have parallelism all the way to the hardware in the best
case. If you need to merge file, there could f.e. be a background process
grabbing individual pcap files and merge them based on the time-stamps into
a single one, e.g. mergecap:
https://www.wireshark.org/docs/wsug_html_chunked/AppToolsmergecap.html
Hope that helps,
Thanks,
Daniel
So far, I have tried to start 3 instances with :
sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --mmap --ring-size
256MiB --bind-cpu 18 --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix
"eth5." --interval 60sec &
sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --mmap --ring-size
256MiB --bind-cpu 20 --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix
"eth5." --interval 60sec &
sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --mmap --ring-size
256MiB --bind-cpu 22 --silent --in eth5 --out /mnt/sdb1/netcapture/ --prefix
"eth5." --interval 60sec &
However, since interval isn't exactly 60 seconds, after 1-2 days I end up with
separate output files, like :
-rw-r--r-- 1 root root 135M Apr 30 14:44
/mnt/sdb1/netcapture/eth5.1430405040.pcap
-rw-r--r-- 1 root root 125M Apr 30 14:44
/mnt/sdb1/netcapture/eth5.1430405041.pcap
$ tcpslice /mnt/sdb1/netcapture/eth5.1430404980.pcap -t
/mnt/sdb1/netcapture/eth5.1430404980.pcap 2015y04m30d14h43m00s733651u
2015y04m30d14h44m00s742344u
$ tcpslice /mnt/sdb1/netcapture/eth5.1430404981.pcap -t
/mnt/sdb1/netcapture/eth5.1430404981.pcap 2015y04m30d14h43m01s118241u
2015y04m30d14h44m01s138441u
Am I doing something wrong the way I start instances, is there different way to
start 3 instances to write into single output pcap file ?
Also, I was wondering if there are any plans to make command line ability to
start multiple instances using something like one command line with --bind-cpu
18,20,22 and one --out file, which would trigger 3 netsniff-ng instances while
output goes into single output pcap file ? ( SolarCapture/SolarFlare uses that
approach with multiple capture cores and one writeout core )
Let me know if you need more details.
Best Regards
Ivan
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
