Hi all, I am very sorry but it looks like this was working all the time at least in couple of modes but I messed up ls command and didn't see other files ! I use ls eth5* rather than eth5-0*, eth5-1* and there were so many files in folder so I didn't see other instances when sorted by name !
This works just fine with this older kernel, other than qm and rnd modes, which don't really need that much. Since I lock Rx queues to CPUs, I could use that mode. Also, mode "lb" was also producing very even file size and evenly distributed CPU utilization. 3 instances for example : -rw-r--r-- 1 root root 484M May 7 14:35 /mnt/sdb1/netcapture/eth5-0.1431009240.pcap -rw-r--r-- 1 root root 431M May 7 14:36 /mnt/sdb1/netcapture/eth5-0.1431009300.pcap -rw-r--r-- 1 root root 485M May 7 14:35 /mnt/sdb1/netcapture/eth5-1.1431009240.pcap -rw-r--r-- 1 root root 431M May 7 14:36 /mnt/sdb1/netcapture/eth5-1.1431009300.pcap -rw-r--r-- 1 root root 487M May 7 14:35 /mnt/sdb1/netcapture/eth5-2.1431009240.pcap -rw-r--r-- 1 root root 430M May 7 14:36 /mnt/sdb1/netcapture/eth5-2.1431009300.pcap For start, I will use that approach of processing sub-folders based on names via mergecap counting on Linux cash still holding most recent 1 minute files in cache for fast processing. I would keep an eye if someone introduces that method of eventually directing multiple netsniff-ng child instances into one which would write into single file. Considering fast I/O and SSDs used, that might still work ok for some users. Regards Ivan -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
