Hi The attached file shows the basic network connection of the virtual machines. The ESXi host has 32GB of RAM runs two VM both Ubuntu 14.04 LTS 64 bit OS Server. Sniffer OS : 26GB of RAM allocated, 4 virtual sockets with 2 cores : 8 cores in total , In the end, need to run 3 sniffer application instances on eth1, eth2 and eth 3 simultaneously with filter as follows : 1) Job 1 , sniffing on eth1, filter : dst net 224.10 .10 or dst net 224.11.11 2)Job 2, sniffing on eth2, filter : portrange 30000 to 380000 3) Job 3 , sniffing on eth 1, filter : :dst net not 224.10.10 and dst net not 224.11.11 and portrange not 30000-38000
Max data rate on network is 100Mbps Tcpreplay has 8Gb of RAM allocated , pushes already available pcap files @100Mbps on loop I hope this has all the information you require. regards Jishnu -----Original Message----- From: Vadim Kochan [mailto:[email protected]] Sent: 22. juli 2015 11:45 AM To: Unnikannan Nair, Jishnu Cc: '[email protected]' Subject: Re: [netsniff-ng] netsniff-ng 100%CPU usgae On Wed, Jul 22, 2015 at 09:11:56AM +0000, Unnikannan Nair, Jishnu wrote: > Hi > I'm trying to use netsniff-ng to sniff on 3 different UDP streams. As > for testing I started with one instance of netsniff-ng bind to CPU 2 > with tcpreplay sending packets at 100Mbps (max limit on our network) > > Netsniff-ng command : > > sudo netsniff-ng -i eth1 -out=/share/job1/ --prefix="job1_" --interval 2MiB > -ring-size 10GiB -s -prio-high -f "dst net 224.10.10" -b 2 > > The sniffer is running on ESXi with 26GB of RAM alloted for this VM and 8 > cores of CPU. > > TCP replay command : > > tcpreplay -i eth1 -M 100Mbps -loop 100 -preload-pcap -sleep-accel=1 > /home/caps/*.pcap > > > > Sniffer starts normally but after creating around 268 files (each of 2MiB ) > the process just takes 100% of CPU and locks. Why is this happening? > > Attached capture you can see the htop output > > I also have a question about using fanout, as I intend to have 3 instances of > the application, but coming from different subnet (different filters will be > used), which would be the best possible way to start those instances, should > I use fanout option ? > > > > > > > > regards > > > Jishnu > > -- > You received this message because you are subscribed to the Google Groups > "netsniff-ng" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected]. > For more options, visit https://groups.google.com/d/optout. Hi, Do you use Host <-> VM connection or you have 2 physical connections ? Actually, may be I will try to follow your instructions but I have only one i7 ThinkPad, so I can only simulate your case on the same host ... will try at the end of day ... So if you have some specific setup/notes, you can provide them. Regards, -- You received this message because you are subscribed to the Google Groups "netsniff-ng" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. For more options, visit https://groups.google.com/d/optout.
