Hello, I have a box running this version of pf_ring
[PF_RING] Welcome to PF_RING 5.2.3 ($Revision: 5172$) (C) 2004-11 L.Deri <[email protected]> [PF_RING] registered /proc/net/pf_ring/ NET: Registered protocol family 27 [PF_RING] Min # ring slots 4096 [PF_RING] Slot version 13 [PF_RING] Capture TX No [RX only] [PF_RING] Transparent Mode 0 [PF_RING] IP Defragment No [PF_RING] Initialized correctly I'm mainly using it for the cluster load balancing support. Traffic levels are only around 100 Kpps. The box is currently running the following: * 2x snort processes using pf_ring daq in a cluster * 1x tcpdump process using the pf_ring tcpdump * a handful of other applications using standard libpcap not yet re-built against pf_ring Things are working well except that I noticed after about a day the traffic levels reported by the box start to drop off until they get down to about 100mbit. The interesting thing is that killing and restarting the two snort processes causes the traffic levels to bounce back. Attached is a graph from munin showing the rx bytes on the capture interface. Keep in mind the Y axis is upside down. It should look something like a sine wave, but you can see starting around midnight on tuesday it begins to drop off until I restarted snort around 12:00. Once I did that the traffic jumped back to almost 600mbit. The munin monitor uses /proc/net/dev, so it's not measuring capture performance itself. The box is a bit overloaded (it is being replaced in a few weeks) but I'm not sure if that could explain this problem. -- -- Justin Azoff -- Network Security & Performance Analyst
<<attachment: pf_ring_traffic_problem.png>>
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
