Hi Ivan,
On 04/30/2015 08:55 PM, [email protected] wrote:
While I am trying to work using separate files and changed prefix for each
instance trying to pursue mergecap approach, I notice that only 1 file ( last
prefix named instance ) gets written.
I see 3 netsniff-ng processes when I start it in top as well as in ps aux :
sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts
defrag --ring-size 128MiB --bind-cpu 18 --notouch-irq --silent --in eth5 --out
/mnt/sdb1/netcapture/ --prefix "eth50." --interval 60sec &
sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts
defrag --ring-size 128MiB --bind-cpu 20 --notouch-irq --silent --in eth5 --out
/mnt/sdb1/netcapture/ --prefix "eth51." --interval 60sec &
sudo nohup /usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts
defrag --ring-size 128MiB --bind-cpu 22 --notouch-irq --silent --in eth5 --out
/mnt/sdb1/netcapture/ --prefix "eth52." --interval 60sec &
Interesting, lets say if you use --fanout-type lb, would that make a difference?
This should round robin each packet between these 3 processes, so you should
definitely see something unless we have a bug. ;) Let me know, so we can look
further ...
Thanks!
Daniel
$ ps aux | grep netsniff-ng
root 2286 0.0 0.0 43312 1672 pts/0 S 18:47 0:00 sudo nohup
/usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts
defrag --ring-size 128MiB --bind-cpu 18 --notouch-irq --silent --in eth5 --out
/mnt/sdb1/netcapture/ --prefix eth50. --interval 60sec
root 2287 0.0 0.0 43312 1676 pts/0 S 18:47 0:00 sudo nohup
/usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts
defrag --ring-size 128MiB --bind-cpu 20 --notouch-irq --silent --in eth5 --out
/mnt/sdb1/netcapture/ --prefix eth51. --interval 60sec
root 2288 0.0 0.0 43312 1672 pts/0 S 18:47 0:00 sudo nohup
/usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts
defrag --ring-size 128MiB --bind-cpu 22 --notouch-irq --silent --in eth5 --out
/mnt/sdb1/netcapture/ --prefix eth52. --interval 60sec
root 2289 2.9 0.8 226492 210060 pts/0 SL 18:47 0:07
/usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts
defrag --ring-size 128MiB --bind-cpu 18 --notouch-irq --silent --in eth5 --out
/mnt/sdb1/netcapture/ --prefix eth50. --interval 60sec
root 2290 3.3 0.8 226492 210060 pts/0 SL 18:47 0:08
/usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts
defrag --ring-size 128MiB --bind-cpu 20 --notouch-irq --silent --in eth5 --out
/mnt/sdb1/netcapture/ --prefix eth51. --interval 60sec
root 2291 2.8 0.8 226492 210060 pts/0 SL 18:47 0:06
/usr/local/sbin/netsniff-ng --fanout-group 1 --fanout-type hash --fanout-opts
defrag --ring-size 128MiB --bind-cpu 22 --notouch-irq --silent --in eth5 --out
/mnt/sdb1/netcapture/ --prefix eth52. --interval 60sec
But I see only eth52.epoch.pcap written :
-rw-r--r-- 1 root root 251M Apr 30 18:49
/mnt/sdb1/netcapture/eth52.1430419680.pcap
-rw-r--r-- 1 root root 272M Apr 30 18:50
/mnt/sdb1/netcapture/eth52.1430419740.pcap
-rw-r--r-- 1 root root 245M Apr 30 18:51
/mnt/sdb1/netcapture/eth52.1430419800.pcap
-rw-r--r-- 1 root root 214M Apr 30 18:52
/mnt/sdb1/netcapture/eth52.1430419860.pcap
-rw-r--r-- 1 root root 57M Apr 30 18:52
/mnt/sdb1/netcapture/eth52.1430419920.pcap
Am I doing something wrong ?
Regards
Ivan
--
You received this message because you are subscribed to the Google Groups
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
For more options, visit https://groups.google.com/d/optout.
