Hello, Few months ago we were testing PF_RING and found a similar behaviour.
We were using 6x snort and noticed that in few hours (or maybe a day, don't remember exactly) the traffic level dropped to only around 100Mbps, when the switch graphs showed more than 700 Mbps on the wire. Back then, we thougt it was a problem with our NIC (bnx2 driver) and discarded PF_RING usage. If you find a solution to this problem, I think we will be able to retest again to see if it works better. Thank you very much, Jose Vila. On Fri, Mar 2, 2012 at 12:00, <[email protected]>wrote: > Message: 1 > Date: Thu, 1 Mar 2012 09:24:49 -0500 > From: Justin Azoff <[email protected]> > To: [email protected] > Subject: Re: [Ntop-misc] strange traffic level drop over time > Message-ID: <[email protected]> > Content-Type: text/plain; charset=us-ascii > > On Thu, Mar 01, 2012 at 09:32:50AM +0100, Luca Deri wrote: > > Justin > > Via the pfring DAQ we inject drop rules in the kernel whenever snort > > detects bad traffic. It might be that these rules are causing the > > problem you see as all the rules are removed when you restart snort. > > Can you please check what traffic is dropped and verify if my feelings > > are correct? > > I'm not sure how to figure out what traffic is actually being dropped, > but I did notice this: > > tucker:/proc/net/pf_ring# grep 'Rules' 2*;echo;sleep 5;grep 'Rules' 2* > 20568-sniff1.63:# Sw Filt. Rules : 24261 > 20568-sniff1.63:# Hw Filt. Rules : 0 > 20571-sniff1.64:# Sw Filt. Rules : 24390 > 20571-sniff1.64:# Hw Filt. Rules : 0 > > 20568-sniff1.63:# Sw Filt. Rules : 24415 > 20568-sniff1.63:# Hw Filt. Rules : 0 > 20571-sniff1.64:# Sw Filt. Rules : 24528 > 20571-sniff1.64:# Hw Filt. Rules : 0 > > is that what you are referring to? > > I'm not sure why the daq module should do this in the first place.. > especially when not running inline. > > -- > -- Justin Azoff > -- Network Security & Performance Analyst > > > ------------------------------ > > _______________________________________________ > Ntop-misc mailing list > [email protected] > http://listgateway.unipi.it/mailman/listinfo/ntop-misc > > > End of Ntop-misc Digest, Vol 93, Issue 2 > **************************************** >
_______________________________________________ Ntop-misc mailing list [email protected] http://listgateway.unipi.it/mailman/listinfo/ntop-misc
