Hi
I'm trying to build a network sniffer for UDP multicast streams using 
netsniff-ng. I have deployed two linux systems (Ubuntu server 14.04 LTS) on an 
ESXi one has the sniffer and other has tcpreplay sending packets at needed 
Mbps. The configuration is:
Sniffer:

*         Intel i7 3770 3.4GHz

*         2 cores added to the sniffer VM

*         16GB RAM



The sniffer job is  as follows :

Sudo netsniff-ng -I eth1 -out=/share/job1/ --prefix="job1_"  --interval 2MiB 
-ring-size 3GiB -prio-high -f "dst net 224.10.10" -user 1000 -group 1000 -b 1



The tcp replay job is as follows

tcpreplay -i eth1 -M 80Mbps -loop 100 -preload-pcap -sleep-accel=1  
/home/caps/*.pcap



Tcpreplay sends 10 pcap files , 100 times i.e. total packets send is 10487400 @ 
80.77Mbps but netsniff-ng received only 504813



TCPREPLAY:

Actual: 10487400 packets (5229757800 bytes) sent in 481.67 seconds.            
Rated: 10857554.0 bps, 82.84 Mbps, 21773.00 pps

Statistics for network device: eth1

        Attempted packets:         10487400

        Successful packets:        10487400

        Failed packets:            0

        Retried packets (ENOBUFS): 0

        Retried packets (EAGAIN):  0



NETSNIFF_NG:

504813  packets incoming (9982587 unread on exit)

5929469  packets passed filter

4557931  packets failed filter (out of space)

43.4610% packet droprate

559  sec, 715362 usec in total

Cannot set NIC flags!



I have increased the kernel RX Cache to 1GB in /etc/sysctl.conf, but it did not 
have any effect. Could someone give me some information as to how to fix this?? 
Also the last line "Cannot set NIC Flag" what does that mean?? Is that an 
error?? My target is to run two instance of netsniff on eth1 and eth2 with 
different filters and bind them on CPU 1 and CPU 2 later on.



Regards

Jishnu



Jishnu Unnikannan Nair | Systems Engineer
NOV Rig Systems
Systems & Controls | Drilling data Center
Lagerveien 8| 4033 Stavanger, Norway
T   +475.181.8181
M +473.819.4208
E   [email protected]
nov.com<http://www.nov.com/>
Connect with us on Facebook<https://www.facebook.com/NationalOilwellVarco> | 
LinkedIn<http://www.linkedin.com/company/national-oilwell-varco?trk=tyah&trkInfo=tarId%3A1405455811306%2Ctas%3Anational+oilwell%2Cidx%3A2-1-4>
 | Twitter<https://twitter.com/NOVGlobal>
The information contained in this transmission is for the personal and 
confidential use of the individual or entity to which it is addressed. If the 
reader is not the intended recipient, you are hereby notified that any review, 
dissemination, or copying of this communication is strictly prohibited. If you 
have received this transmission in error, please notify the sender immediately.


-- 
You received this message because you are subscribed to the Google Groups 
"netsniff-ng" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
For more options, visit https://groups.google.com/d/optout.

Reply via email to