On Thu, Apr 30, 2015 at 05:42:41PM +0200, Daniel Borkmann wrote: > Hi Ivan, > > On 04/30/2015 05:28 PM, [email protected] wrote: > >Hi all, > > > >I have been using netsniff-ng for some time now and am very excited about > >packet fanout feature. > > Cool, great to hear! :) > > >Have one AF_PACKET hash fanout functionality related question if somebody > >has time to comment : > > > >how can I get 3 or more netsniff-ng instances in one fanout-group output > >into 1 single PCAP file ? > > You below command-line invocation looks good to me. Letting all processes > write into one single pcap file at one, I'm afraid, won't work. There are > various reasons, i.e. it would corrupt the pcap file as there's no > synchronization between the processes to write a single packet atomically > into the pcap. > > You also wouldn't want to do that. ;) Because assume if such a possibility > would exist, then the bottleneck becomes easily the write to disc on that > single file. > > You rather want to have parallelism all the way to the hardware in the best > case. If you need to merge file, there could f.e. be a background process > grabbing individual pcap files and merge them based on the time-stamps into > a single one, e.g. mergecap: > > https://www.wireshark.org/docs/wsug_html_chunked/AppToolsmergecap.html > > Hope that helps, > > Thanks, > Daniel > > >So far, I have tried to start 3 instances with : > > > >sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash > >--mmap --ring-size 256MiB --bind-cpu 18 --silent --in eth5 --out > >/mnt/sdb1/netcapture/ --prefix "eth5." --interval 60sec & > >sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash > >--mmap --ring-size 256MiB --bind-cpu 20 --silent --in eth5 --out > >/mnt/sdb1/netcapture/ --prefix "eth5." --interval 60sec & > >sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash > >--mmap --ring-size 256MiB --bind-cpu 22 --silent --in eth5 --out > >/mnt/sdb1/netcapture/ --prefix "eth5." --interval 60sec & > > > >However, since interval isn't exactly 60 seconds, after 1-2 days I end up > >with separate output files, like : > > > >-rw-r--r-- 1 root root 135M Apr 30 14:44 > >/mnt/sdb1/netcapture/eth5.1430405040.pcap > >-rw-r--r-- 1 root root 125M Apr 30 14:44 > >/mnt/sdb1/netcapture/eth5.1430405041.pcap > >$ tcpslice /mnt/sdb1/netcapture/eth5.1430404980.pcap -t > >/mnt/sdb1/netcapture/eth5.1430404980.pcap 2015y04m30d14h43m00s733651u > > 2015y04m30d14h44m00s742344u > >$ tcpslice /mnt/sdb1/netcapture/eth5.1430404981.pcap -t > >/mnt/sdb1/netcapture/eth5.1430404981.pcap 2015y04m30d14h43m01s118241u > > 2015y04m30d14h44m01s138441u > > > >Am I doing something wrong the way I start instances, is there different way > >to start 3 instances to write into single output pcap file ? > > > >Also, I was wondering if there are any plans to make command line ability to > >start multiple instances using something like one command line with > >--bind-cpu 18,20,22 and one --out file, which would trigger 3 netsniff-ng > >instances while output goes into single output pcap file ? ( > >SolarCapture/SolarFlare uses that approach with multiple capture cores and > >one writeout core ) > > > >Let me know if you need more details. > > > >Best Regards > > > >Ivan > > > > -- > You received this message because you are subscribed to the Google Groups > "netsniff-ng" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout.
Hi, What about if netsniff-ng can fork children so each children will use separate output file in specified directory and at the end after all children done then the main netsniff-ng will merge these files into one, and remove the files which were generated by children... Just thoughts ... Regards, Vadim Kochan -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
