Hi Daniel, > Interesting, lets say if you use --fanout-type lb, would that make a > difference? > > This should round robin each packet between these 3 processes, so you should > definitely see something unless we have a bug. ;) Let me know, so we can look > further ...
no change if using --fanout-type lb. I see all 3 instances run and show similar CPU % in top, but only last file seems to be on my SSD. BTW, --fanout-type qm returns "$ Cannot set fanout ring mode!", that's why I switched to type cpu. ( considering I use irq affinity script to lock Rx queues to certain CPUs and also I lock netsniff-ng, I guess it doesn't matter which one I use cpu or qm ) Let me know if you need more details about my system or if there is anything else I can help with to troubleshoot. Regarding merge script, one I use isn't very generic and it has one flaw :) Since I generate 1 minute files and I try to make pcap files start on 00.000, I used "HiRes time under GNU-Linux" script to wait until exact begin of minute before I start netsniff-ng. After that, I just run cronjob every minute to merge files from previous minute using something like this : t2=`date +%s --date="1 minutes ago"` curminute=$(($t2 - ($t2 % ( 1 * 60 )))) t2=$curminute file1=/mnt/sdc1/netcapture/eth6.$t2.pcap Obviously, in order to make it universal, we would need to know how many instances of netsniff-ng run and some people might record into rotating set of files or space, some record to the extend of space and delete % of oldest files. Not sure how to tackle those subjects, but will try to come up with something. Also, the issue with my approach is that files in --interval 60 drift little bit and next file doesn't really start at 00.000 of next minute, so after certain time my formula doesn't work because file eth6.1430482620.pcap will become 1430483341.pcap ( on solar_capture somehow, it stays within 1 ms for months running 24/7 ) Maybe I have to use incron IN_MOVED_TO to trigger tasks rather predicting file names. Regards Ivan -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
